Commit e6154985 authored by jan.koester's avatar jan.koester
Browse files

tls: client accepts a ServerHello without extensions, resets EMS 

The extensions block of a ServerHello is optional (RFC 5246 7.4.1.3);
a TLS 1.2 server with nothing to echo (e.g. no EMS) omits it, and the
client failed with "ServerHello missing extensions". Also reset
extended_master_secret before parsing, so a reused tls object does not
keep EMS from an earlier handshake the server no longer echoes.

Checked against openssl s_server: ECDHE-ECDSA-AES{128,256}-GCM with and
without EMS, TLS 1.3.

Co-Authored-By: default avatarClaude Opus 5.5 <noreply@anthropic.com>
parent 8aa41ebb

src/crypto/tls.cpp

+10 −3
Changes for src/crypto/tls.cpp: 10 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -1761,14 +1761,21 @@ namespace netplus { 
                    uint8_t comp = p[off++];

                    (void)comp;



                    // extensions length (2)

                    // extensions length (2) -- the whole block is optional (RFC 5246

                    // 7.4.1.3): a TLS 1.2 server with nothing to echo omits it

                    uint16_t ext_len = 0;

                    if (off != n) {

                        if (off + 2 > n) {

                            NetException e;

                        e[NetException::Error] << "ServerHello missing extensions";

                            e[NetException::Error] << "ServerHello extensions length truncated";

                            throw e;

                        }

                    uint16_t ext_len = (uint16_t(p[off]) << 8) | p[off+1];

                        ext_len = (uint16_t(p[off]) << 8) | p[off+1];

                        off += 2;

                    }



                    // only what this ServerHello echoes counts, not a previous handshake

                    extended_master_secret = false;



                    if (off + ext_len > n) {

                        NetException e;