[openssl/openssl] 54aef3: Reject HelloRequest in TLS 1.3

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 54aef373f3265a6b3f2d757a2f24473381157dea
      https://github.com/openssl/openssl/commit/54aef373f3265a6b3f2d757a2f24473381157dea
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-06-24 (Wed, 24 Jun 2026)

  Changed paths:
    M ssl/statem/statem_lib.c
    M test/recipes/70-test_tls13messages.t

  Log Message:
  -----------
  Reject HelloRequest in TLS 1.3

TLS 1.3 reserves handshake message type 0 and must not silently
ignore HelloRequest records. The legacy client-side HelloRequest skip
path in tls_get_message_header() could run before the TLS 1.3 state
machine had a chance to reject the message, so a zero-length
HelloRequest injected after ClientHello was discarded instead of
triggering unexpected_message.

Restrict the skip to cases where TLS 1.3 is no longer possible.
Before ServerHello selects a version, s->version is the configured
maximum; after ServerHello or during renegotiation, it is the
negotiated version. Skip only when that value is below TLS 1.3,
preserving the existing TLS 1.2-and-below behavior.

Add TLSProxy regression tests covering rejection while TLS 1.3 is
possible and the preserved TLS 1.2 skip after ServerHello.

Fixes #31531

Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Wed Jun 24 13:01:12 2026
(Merged from https://github.com/openssl/openssl/pull/31577)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/25b379-54aef3%40github.com.