Tobias Brunner bff18d9048 tls-protection: Reject unencrypted TLS 1.3 records ...

We only allow unencrypted change_cipher_spec records (as before), which
are handled by the upper layers accordingly.  Without the check, we
also accepted unprotected alerts and handshake records that could
potentially cause state confusion.

Fixes: 7a2b02667c ("libtls: Implement TLS 1.3 handshake on client-side")

2026-07-23 10:26:08 +02:00

..

tests

unit-tests: Replace expired self-signed TLS certificates

2026-05-22 14:33:28 +02:00

Makefile.am

libtls: Implement HKDF for TLS 1.3

2021-02-12 11:45:44 +01:00

tls_aead_expl.c

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_aead_impl.c

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_aead_null.c

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_aead_seq.c

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_aead.c

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_aead.h

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_alert.c

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_alert.h

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_application.h

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_cache.c

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_cache.h

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_compression.c

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_compression.h

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_crypto.c

libtls: Fix double-free when enumerating private keys

2025-08-22 12:07:55 +02:00

tls_crypto.h

Rename MODP_NONE to KE_NONE

2022-06-29 10:28:50 +02:00

tls_eap.c

libtls: Fix build with DEBUG_LEVEL < 3

2023-05-08 17:32:17 +02:00

tls_eap.h

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_fragmentation.c

libtls: Fix build with DEBUG_LEVEL < 3

2023-05-08 17:32:17 +02:00

tls_fragmentation.h

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_handshake.h

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_hkdf.c

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_hkdf.h

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_peer.c

tls-peer: Ensure TLS 1.3 CertificateRequest structure is valid

2026-04-02 08:14:29 +02:00

tls_peer.h

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_prf.c

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_prf.h

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_protection.c

tls-protection: Reject unencrypted TLS 1.3 records

2026-07-23 10:26:08 +02:00

tls_protection.h

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_server.c

tls-server: Prevent infinite loop if supported versions are too short

2026-04-21 16:48:56 +02:00

tls_server.h

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls_socket.c

tls-socket: Avoid accessing stale data when processing application data

2026-07-21 10:37:43 +02:00

tls_socket.h

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00

tls.c

tls: Only return EAP MSK if TLS handshake is complete

2023-03-21 16:11:49 +01:00

tls.h

Update copyright headers after acquisition by secunet

2022-06-28 10:22:56 +02:00