From 76de1b05ae95b6c723eb5f8978f96e4870e57518 Mon Sep 17 00:00:00 2001
From: Martin Nilsson <nilsson@opera.com>
Date: Mon, 22 Sep 2014 17:13:04 +0200
Subject: [PATCH] The TLS padding extension is implemented. The actual
extension ID is still undecided, but doesn't matter.
---
lib/modules/SSL.pmod/Constants.pmod | 2 +-
lib/modules/SSL.pmod/ServerConnection.pike | 7 +++++++
2 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/lib/modules/SSL.pmod/Constants.pmod b/lib/modules/SSL.pmod/Constants.pmod
index 55bee83680..56c3af24ee 100644
--- a/lib/modules/SSL.pmod/Constants.pmod
+++ b/lib/modules/SSL.pmod/Constants.pmod
@@ -67,7 +67,7 @@
* [/] 56-bit Export Cipher draft-ietf-tls-56-bit-ciphersuites-01.txt
* [/] Next Protocol Negotiation draft-agl-tls-nextprotoneg
* [ ] Chacha20Poly1305 draft-agl-tls-chacha20poly1305-02.txt
- * [ ] TLS Padding draft-agl-tls-padding
+ * [/] TLS Padding draft-agl-tls-padding
* [X] TLS Fallback SCSV draft-ietf-tls-downgrade-scsv-00.txt
* [ ] SSL 3.4/TLS 1.3 draft-ietf-tls-tls13-02.txt
* [ ] Prohibit RC4 draft-ietf-tls-prohibiting-rc4
diff --git a/lib/modules/SSL.pmod/ServerConnection.pike b/lib/modules/SSL.pmod/ServerConnection.pike
index 3b9dc64ff6..71862cfe44 100644
--- a/lib/modules/SSL.pmod/ServerConnection.pike
+++ b/lib/modules/SSL.pmod/ServerConnection.pike
@@ -561,6 +561,13 @@ int(-1..1) handle_handshake(int type, string(8bit) data, string(8bit) raw)
}
break;
+ case EXTENSION_padding:
+ if( !equal(String.range((string)extension_data), ({0,0})) )
+ send_packet(alert(ALERT_fatal, ALERT_illegal_parameter,
+ "Possible covert side channel in padding.\n"
+ ));
+ break;
+
default:
SSL3_DEBUG_MSG("Unhandled extension %O (%d bytes)\n",
(string)extension_data,
--
GitLab