[openssl/openssl] 3e4f7e: Reject unknown TLS 1.3 ServerHello extensions

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 3e4f7e77208138174ce50f0403ce6b947cb1d509
      https://github.com/openssl/openssl/commit/3e4f7e77208138174ce50f0403ce6b947cb1d509
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-07-23 (Thu, 23 Jul 2026)

  Changed paths:
    M ssl/statem/extensions.c
    M ssl/statem/statem_clnt.c
    M ssl/statem/statem_local.h
    M test/ech_corrupt_test.c
    M test/recipes/70-test_sslextension.t
    M util/perl/TLSProxy/Message.pm

  Log Message:
  -----------
  Reject unknown TLS 1.3 ServerHello extensions

TLS 1.3 does not permit clients to ignore unknown extensions in ServerHello
or HelloRetryRequest. Add a validation pass for these messages so fully
unknown extension types fail early with unsupported_extension.

Keep the existing ignore behavior for other extension contexts and leave
TLS 1.2 ServerHello processing unchanged. Add TLSProxy coverage for the
TLS 1.3 ServerHello case.

Correct the unknown-extension path in tls_collect_extensions(). Collection
still runs before the new TLS 1.3 validation, and verify_extension()
returns success with thisex == NULL for fully unknown extension types.
The previous idx calculation used invalid pointer arithmetic on NULL in
that path. Map unknown extensions explicitly outside the built-in extension
range instead, preserving the existing ignore semantics while avoiding
undefined behavior.

Update the truncated HRR ECH corruption vector to keep testing malformed
ECH length after the new unknown-extension validation. The old 0xdddd bytes
were only padding to preserve the replacement length, but they now trigger
the unknown-extension check before the ECH parser. Use a known HRR cookie
extension as padding so the test still reaches the intended
SSL_R_LENGTH_MISMATCH path.

Reviewed-by: Andrew Dinh <[email protected]>
Reviewed-by: Daniel Kubec <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Thu Jul 23 15:55:09 2026
(Merged from https://github.com/openssl/openssl/pull/31086)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/d2c0db-3e4f7e%40github.com.