Page MenuHomeFreeBSD

ktls: Reject attempts to enable AES-CBC with TLS 1.3.
ClosedPublic

Authored by jhb on Sat, Oct 9, 3:13 PM.

Details

Summary

AES-CBC cipher suites are not supported in TLS 1.3.

Reported by: syzbot+ab501c50033ec01d53c6@syzkaller.appspotmail.com

Diff Detail

Repository
R10 FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

jhb requested review of this revision.Sat, Oct 9, 3:13 PM

I haven't tested this yet. I can try to do that this week unless one of y'all want to beat me to it.

In D32404#731030, @jhb wrote:

I haven't tested this yet. I can try to do that this week unless one of y'all want to beat me to it.

I verified that the repro works and that this patch causes it to return EINVAL instead.

This revision is now accepted and ready to land.Sat, Oct 9, 3:30 PM

I've tested that all the expected cipher suites and versions still work.