mirrors/openssl
0
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-01-12 04:53:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

Increment size limit for ClientHello messages

Browse Source 
The current limit of 2^14 bytes is too low (e.g. RFC 5246 specifies the
maximum size of just the extensions field to be 2^16-1), and may cause
bogus failures.

RT#4063

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/413)
This commit is contained in:
Alessandro Ghedini 2015-09-25 17:53:58 +02:00 committed by Rich Salz
parent c32b9dcac2
commit 8a18bc2588
1 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
ssl/statem/statem_srvr.c
View File

@ -747,6 +747,23 @@ int ossl_statem_server_construct_message(SSL *s)
return 0;
}
/*
* Maximum size (excluding the Handshake header) of a ClientHello message,
* calculated as follows:
*
* 2 + # client_version
* 32 + # only valid length for random
* 1 + # length of session_id
* 32 + # maximum size for session_id
* 2 + # length of cipher suites
* 2^16-2 + # maximum length of cipher suites array
* 1 + # length of compression_methods
* 2^8-1 + # maximum length of compression methods
* 2 + # length of extensions
* 2^16-1 # maximum length of extensions
*/
#define CLIENT_HELLO_MAX_LENGTH 131396
#define CLIENT_KEY_EXCH_MAX_LENGTH 2048
#define NEXT_PROTO_MAX_LENGTH 514
@ -760,7 +777,7 @@ unsigned long ossl_statem_server_max_message_size(SSL *s)
switch(st->hand_state) {
case TLS_ST_SR_CLNT_HELLO:
return SSL3_RT_MAX_PLAIN_LENGTH;
return CLIENT_HELLO_MAX_LENGTH;
case TLS_ST_SR_CERT:
return s->max_cert_list;