diff options
| author | Daiki Ueno <dueno@redhat.com> | 2019-04-25 17:08:43 +0200 |
|---|---|---|
| committer | Daiki Ueno <dueno@redhat.com> | 2019-05-14 06:44:38 +0200 |
| commit | 2dc96e3b8d0e043bebf0815edaaa945f66ac0531 (patch) | |
| tree | df3932ecaf592291b53cb8936d23ba19f9226f50 /lib/constate.c | |
| parent | 9509af0e791b74538de8ffa8dd0d47c05cb08eed (diff) | |
| download | gnutls-2dc96e3b8d0e043bebf0815edaaa945f66ac0531.tar.gz | |
ext/record_size_limit: distinguish sending and receiving limitstmp-record-sizes
The previous behavior was that both sending and receiving limits are
negotiated to be the same value. It was problematic when:
- client sends a record_size_limit with a large value in CH
- server sends a record_size_limit with a smaller value in EE
- client updates the limit for both sending and receiving, upon
receiving EE
- server sends a Certificate message larger than the limit
With this patch, each peer maintains the sending / receiving limits
separately so not to confuse with the contradicting settings.
Signed-off-by: Daiki Ueno <dueno@redhat.com>
Diffstat (limited to 'lib/constate.c')
| -rw-r--r-- | lib/constate.c | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/lib/constate.c b/lib/constate.c index be784bce64..51a4eca30a 100644 --- a/lib/constate.c +++ b/lib/constate.c @@ -821,14 +821,12 @@ int _gnutls_write_connection_state_init(gnutls_session_t session) session->security_parameters.epoch_next; int ret; - /* reset max_record_recv_size if it was negotiated in the + /* reset max_record_send_size if it was negotiated in the * previous handshake using the record_size_limit extension */ - if (session->security_parameters.max_record_recv_size != - session->security_parameters.max_record_send_size && - !(session->internals.hsk_flags & HSK_RECORD_SIZE_LIMIT_NEGOTIATED) && + if (!(session->internals.hsk_flags & HSK_RECORD_SIZE_LIMIT_NEGOTIATED) && session->security_parameters.entity == GNUTLS_SERVER) - session->security_parameters.max_record_recv_size = - session->security_parameters.max_record_send_size; + session->security_parameters.max_record_send_size = + session->security_parameters.max_user_record_send_size; /* Update internals from CipherSuite selected. * If we are resuming just copy the connection session |