Fenrir fixes - #11161
Open
mattia-moffa wants to merge 4 commits into
Open
Conversation
Fixes F#9091 We can't choose the cipher based on the negotiated cipher strength without restructuring how resumption ticket keys work, but we can at least default to AES256 when available. WOLFSSL_TICKET_ENC_AES128_GCM will revert to the previous behavior.
Fixes F#9093 Per RFC 7919 § 4, any supported_groups codepoint in 256–511 restricts DHE to FFDHE, even if the specific codepoint is unknown. Previously the parser dropped these codepoints, so TLSX_SupportedFFDHE_Set() never saw the offer and left DHE eligible (with a codepoint unsupported by the peer). This fixes it so that unrecognized FFDHE codepoints are recorded.
Fixes F#9094 HAVE_DH_DEFAULT_PARAMS basically boils down to "not a Qt build", but that's only enforced via autotools/cmake. user_settings.h may omit it unknowingly and silently lose RFC 7919 enforcement.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses multiple “Fenrir” issues by tightening TLS session ticket encryption configuration, improving supported-groups parsing behavior for FFDHE edge cases, and fixing QUIC post-handshake output flushing behavior.
Changes:
- Adjust session ticket key sizing to prefer AES-256 keys when AES-256 support is enabled and AES-128-GCM isn’t explicitly selected.
- Preserve unknown FFDHE named-group codepoints in Supported Groups parsing (server/TLS 1.2 contexts) to enforce RFC 7919 named-group DHE restrictions.
- Prevent potential busy-looping in QUIC post-handshake processing by breaking out when
SendBuffered()returns an error.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
wolfssl/ssl.h |
Updates session ticket key-size selection logic to align with AES-256 “auto” behavior. |
src/tls.c |
Retains unknown-in-range FFDHE group offerings to ensure DHE is constrained to named groups per RFC 7919. |
src/quic.c |
Handles SendBuffered() failures during QUIC post-handshake output flushing to avoid looping on unsent data. |
src/internal.c |
Updates ticket encryption macro default documentation and broadens when TLSX_SupportedFFDHE_Set() is invoked (removing HAVE_DH_DEFAULT_PARAMS gating). |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See commit messages.
Fixes Fenrir 8863, 9091, 9093, 9094