From c169f1395be17e438f71bdad585a51f08666f89c Mon Sep 17 00:00:00 2001 From: yuhan6665 <1588741+yuhan6665@users.noreply.github.com> Date: Sun, 25 May 2025 16:04:50 -0400 Subject: [PATCH] crypto/tls: reject duplicate TLS 1.3 EncryptedExtensions When a TLS 1.3 client processes the server's encryptedExtensionsMsg it should reject instances that contain duplicate extension types. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RFC 8446 ยง4.2 says: There MUST NOT be more than one extension of the same type in a given extension block. This update matches enforcement done in the client hello unmarshalling, but applied to the TLS 1.3 encrypted extensions message unmarshalling. Making this change also allows enabling the DuplicateExtensionClient-TLS-TLS13 BoGo test. Updates #72006 Change-Id: I27a2cd231e4b8762b0d9e2dbd3d8ddd5b87fd5d2 Reviewed-on: https://go-review.googlesource.com/c/go/+/673757 Reviewed-by: David Chase LUCI-TryBot-Result: Go LUCI Auto-Submit: Daniel McCarney Reviewed-by: Filippo Valsorda Reviewed-by: Roland Shoemaker --- handshake_messages.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/handshake_messages.go b/handshake_messages.go index bcd9a83..476a441 100644 --- a/handshake_messages.go +++ b/handshake_messages.go @@ -1056,6 +1056,7 @@ func (m *encryptedExtensionsMsg) unmarshal(data []byte) bool { return false } + seenExts := make(map[uint16]bool) for !extensions.Empty() { var extension uint16 var extData cryptobyte.String @@ -1064,6 +1065,11 @@ func (m *encryptedExtensionsMsg) unmarshal(data []byte) bool { return false } + if seenExts[extension] { + return false + } + seenExts[extension] = true + switch extension { case extensionALPN: var protoList cryptobyte.String