Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use a reasonable record version for close_notify sent before version negotiation #1734

Closed
raycoll opened this issue Apr 3, 2020 · 1 comment · Fixed by #3744
Closed

Use a reasonable record version for close_notify sent before version negotiation #1734

raycoll opened this issue Apr 3, 2020 · 1 comment · Fixed by #3744
Assignees

Comments

@raycoll
Copy link
Contributor

raycoll commented Apr 3, 2020

Problem:

If an application acting as a server calls s2n_shutdown before it receives a complete ClientHello handshake message from the client, s2n will send a close_notify alert record with record version 0x00, 0x00. Receivers are unlikely to handle to handle this record correctly and may mischaractize the reason for connection closure(Closure exception vs parsing exception).

Proposed Solution:

Pick a default record version for records sent before versions are negotiated. Since TLS 1.3 freezes record version to be 0x0303, I recommend using that.

@raycoll raycoll changed the title Use a reasonable record version for close_notify sent before ClientHello Use a reasonable record version for close_notify sent before version negotiation Apr 3, 2020
@raycoll
Copy link
Contributor Author

raycoll commented Apr 3, 2020

one could argue that an application shouldn't call s2n_shutdown before version negotiation is complete, however the spec is not clear here

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants