Re: [PATCH net 2/2] net/tls: handle errors from padding_length()

2019-05-10 Thread Jakub Kicinski
On Fri, 10 May 2019 07:16:44 -0700, John Fastabend wrote: > Jakub Kicinski wrote: > > At the time padding_length() is called the record header > > is still part of the message. If malicious TLS 1.3 peer > > sends an all-zero record padding_length() will stop at > > the record header, and return fu

RE: [PATCH net 2/2] net/tls: handle errors from padding_length()

2019-05-10 Thread John Fastabend
Jakub Kicinski wrote: > At the time padding_length() is called the record header > is still part of the message. If malicious TLS 1.3 peer > sends an all-zero record padding_length() will stop at > the record header, and return full length of the data > including the tail_size. > > Subsequent sub

[PATCH net 2/2] net/tls: handle errors from padding_length()

2019-05-09 Thread Jakub Kicinski
At the time padding_length() is called the record header is still part of the message. If malicious TLS 1.3 peer sends an all-zero record padding_length() will stop at the record header, and return full length of the data including the tail_size. Subsequent subtraction of prot->overhead_size from