[gnutls-devel] GnuTLS | Forbid uncolicited CompressedCertificate messages (!1678)

[Read-only notification of GnuTLS library development activities]

Zoltán Fridrich commented on a discussion on lib/tls13/certificate.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1678#note_1234514333

>  	}
>  
>  	if (decompress_cert) {
> -		ret = decompress_certificate(&buf);
> +		ret = decompress_certificate(session, &buf);
>  		if (ret < 0) {
>  			gnutls_assert();
>  			gnutls_alert_send(session, GNUTLS_AL_FATAL, GNUTLS_A_BAD_CERTIFICATE);

I don't think I can do that as the alert will not be sent in that case. Easy way to test it is by changing the `gnutls_alert_send` into some error which would be translated into `GNUTLS_A_BAD_CERTIFICATE` like `ret = GNUTLS_E_CERTIFICATE_ERROR;`. Then the tls13/compress-cert-neg2 test fails with `didn't receive BAD CERTIFICATE alert`.
I am keeping it as is.

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/1678#note_1234514333
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20230110/26e9b1e5/attachment.html>