andreacavalli/netty5
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Related issue: NETTY-297 Non-ssl clients connecting to ssl server should be able to fail fast

Browse Source 
* More strict SSL packet validation in SslHandler
This commit is contained in:
Trustin Lee 2010-03-03 09:15:06 +00:00
parent 3bbad77075
commit 6aa6694822
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/main/java/org/jboss/netty/handler/ssl/SslHandler.java
View File

@ -539,6 +539,9 @@ public class SslHandler extends FrameDecoder
if (majorVersion >= 3 && majorVersion < 10) { if (majorVersion >= 3 && majorVersion < 10) {
// SSLv3 or TLS // SSLv3 or TLS
packetLength = (buffer.getShort(buffer.readerIndex() + 3) & 0xFFFF) + 5; packetLength = (buffer.getShort(buffer.readerIndex() + 3) & 0xFFFF) + 5;
if (packetLength == 0) {
tls = false;
}
} else { } else {
// Neither SSLv2 or TLSv1 (i.e. SSLv2 or bad data) // Neither SSLv2 or TLSv1 (i.e. SSLv2 or bad data)
tls = false; tls = false;
@ -547,6 +550,7 @@ public class SslHandler extends FrameDecoder
if (!tls) { if (!tls) {
// SSLv2 or bad data - Check the version // SSLv2 or bad data - Check the version
boolean sslv2 = true;
int headerLength = (buffer.getUnsignedByte( int headerLength = (buffer.getUnsignedByte(
buffer.readerIndex()) & 0x80) != 0 ? 2 : 3; buffer.readerIndex()) & 0x80) != 0 ? 2 : 3;
int majorVersion = buffer.getUnsignedByte( int majorVersion = buffer.getUnsignedByte(
@ -558,7 +562,14 @@ public class SslHandler extends FrameDecoder
} else { } else {
packetLength = (buffer.getShort(buffer.readerIndex()) & 0x3FFF) + 3; packetLength = (buffer.getShort(buffer.readerIndex()) & 0x3FFF) + 3;
} }
if (packetLength == 0) {
sslv2 = false;
}
} else { } else {
sslv2 = false;
}
if (sslv2) {
// Bad data - discard the buffer and raise an exception. // Bad data - discard the buffer and raise an exception.
SSLException e = new SSLException( SSLException e = new SSLException(
"not an SSL/TLS record: " + ChannelBuffers.hexDump(buffer)); "not an SSL/TLS record: " + ChannelBuffers.hexDump(buffer));