On Thu, Oct 08, 2015 at 04:12:50PM +0000, Hubert Kario via RT wrote:
> The server does not abort connection upon receiving a Client Hello
> message with malformed session_id field.
>
> Affects 1.0.1, 1.0.2 and master.
>
> In SSLv3 and all versions of TLS (e.g. RFC 5246), the SessionID is
> defined as
>
> opaque SessionID<0..32>;
>
> that means, that any SessionID longer than 32 bytes creates an
> incorrectly formatted Client Hello message, and as such, should be
> rejected.
Can be rejected, and perhaps even should be rejected, but I don't
see a MUST here. It seems there's little harm in tolerating longer
session ids (which never match, so are effectively ignored).
So yes, I support adding a check for this (likely above the PACKET
layer), but I don't think this has much urgency and likely should
not be back-ported to stable releases.
--
Viktor.
_______________________________________________
openssl-dev mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
