Skip to content

Fix TLS 1.3 record padding handling in _nx_secure_tls_process_record (RFC 8446 §5.4) #401

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
EdouardMALOT wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Fix TLS 1.3 record padding handling in _nx_secure_tls_process_record (RFC 8446 §5.4) #401

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 35 additions & 14 deletions nx_secure/src/nx_secure_tls_process_record.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,23 +276,44 @@ NX_PACKET *decrypted_packet;
if (status == NX_SECURE_TLS_SUCCESS)
{

/* In TLS 1.3, encrypted records have a single byte at the
record that contains the message type (e.g. application data,
ect.), which is now the ACTUAL message type. */
status = nx_packet_data_extract_offset(decrypted_packet,
decrypted_packet -> nx_packet_length - 1,
&message_type, 1, &bytes_copied);
if (status || (bytes_copied != 1))
/* RFC 8446 §5.4: the inner content type is the last
* NON-ZERO byte of the plaintext; everything after it is
* record padding. Reading the literal last byte broke any
* padded record (Java JDK HttpClient pads by default) —
* scan back, skip the zeros.
*/
{
error_status = NX_SECURE_TLS_INVALID_PACKET;
ULONG scan_offset = decrypted_packet -> nx_packet_length;
message_type = 0;
while (scan_offset > 0)
{
scan_offset--;
status = nx_packet_data_extract_offset(decrypted_packet,
scan_offset,
&message_type, 1, &bytes_copied);
if (status || (bytes_copied != 1))
{
error_status = NX_SECURE_TLS_INVALID_PACKET;
message_type = 0;
break;
}
if (message_type != 0)
{
break;
}
}
if (message_type == 0)
{
error_status = NX_SECURE_TLS_INVALID_PACKET;
message_length = 0;
}
else
{
message_length = scan_offset;
}
decrypted_packet -> nx_packet_length = message_length;
}

/* Remove the content type byte from the data length to process. */
message_length = message_length - 1;

/* Adjust packet length. */
decrypted_packet -> nx_packet_length = message_length;

/* Increment the sequence number. This is done in the MAC verify
step for 1.2 and earlier, but AEAD includes the MAC so we don't
check the MAC and need to increment here. */
Expand Down
Loading