From eb7b0089a32bfe0cc25aea8748f4b35f315d31a7 Mon Sep 17 00:00:00 2001 From: tb <> Date: Sat, 9 May 2026 11:45:50 +0000 Subject: libssl: record extension lengths in ClientHello hashing The ClientHello hash is intended to ensure that the second CH after an HRR only makes the allowed changes to the TLS extensiosn by recording message type followed by the raw extension data if it must remain unchanged. This makes it possible (in principle) that part of free form extension data is confused with type (and length) information of a subsequent extension. Recording the length after the type prevents such a confusion and fixes the framing of the extensions. Found by Frank Denis ok jsing --- src/lib/libssl/ssl_tlsext.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/lib/libssl/ssl_tlsext.c b/src/lib/libssl/ssl_tlsext.c index d879b3304e..f6fbf43dfd 100644 --- a/src/lib/libssl/ssl_tlsext.c +++ b/src/lib/libssl/ssl_tlsext.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl_tlsext.c,v 1.159 2025/12/04 21:16:17 beck Exp $ */ +/* $OpenBSD: ssl_tlsext.c,v 1.160 2026/05/09 11:45:50 tb Exp $ */ /* * Copyright (c) 2016, 2017, 2019 Joel Sing * Copyright (c) 2017 Doug Hogan @@ -2558,6 +2558,7 @@ tlsext_clienthello_hash_extension(SSL *s, uint16_t type, CBS *cbs) * cookie may be added, padding may be removed. */ struct tls13_ctx *ctx = s->tls13; + uint16_t len = CBS_len(cbs); if (type == TLSEXT_TYPE_early_data || type == TLSEXT_TYPE_cookie || type == TLSEXT_TYPE_padding) @@ -2571,6 +2572,8 @@ tlsext_clienthello_hash_extension(SSL *s, uint16_t type, CBS *cbs) */ if (type == TLSEXT_TYPE_pre_shared_key || type == TLSEXT_TYPE_key_share) return 1; + if (!tls13_clienthello_hash_update_bytes(ctx, (void *)&len, sizeof(len))) + return 0; if (!tls13_clienthello_hash_update(ctx, cbs)) return 0; -- cgit v1.2.3-55-g6feb