浏览代码

LibTLS: Treat a close_notify before agreeing on a cipher suite as a handshake failure

Some TLS implementations (namely, AWS CloudFront) do this instead of
sending handshake_failure for some reason.
Luke 4 年之前
父节点
当前提交
63a94deb43
共有 1 个文件被更改,包括 6 次插入0 次删除
  1. 6 0
      Libraries/LibTLS/Record.cpp

+ 6 - 0
Libraries/LibTLS/Record.cpp

@@ -315,6 +315,12 @@ ssize_t TLSv12::handle_message(const ByteBuffer& buffer)
                 res += 2;
                 alert(AlertLevel::Critical, AlertDescription::CloseNotify);
                 m_context.connection_finished = true;
+                if (!m_context.cipher_spec_set) {
+                    // AWS CloudFront hits this.
+                    dbg() << "Server sent a close notify and we haven't agreed on a cipher suite. Treating it as a handshake failure.";
+                    m_context.critical_error = (u8)AlertDescription::HandshakeFailure;
+                    try_disambiguate_error();
+                }
             }
             m_context.error_code = (Error)code;
         }