[openssl-commits] [openssl] master update

[Matt Caswell]

The branch master has been updated
       via  7835e97b6ff5cd94a10c5aeac439f4aa145a77b2 (commit)
      from  87d06aed64395afcd9ee4e7c699950dd57278259 (commit)


- Log -----------------------------------------------------------------
commit 7835e97b6ff5cd94a10c5aeac439f4aa145a77b2
Author: Matt Caswell <matt at openssl.org>
Date:   Wed Oct 17 16:17:25 2018 +0100

    Don't artificially limit the size of the ClientHello
    
    We were setting a limit of SSL3_RT_MAX_PLAIN_LENGTH on the size of the
    ClientHello. AFAIK there is nothing in the standards that requires this
    limit.
    
    The limit goes all the way back to when support for extensions was first
    added for TLSv1.0. It got converted into a WPACKET max size in 1.1.1. Most
    likely it was originally added to avoid the complexity of having to grow
    the init_buf in the middle of adding extensions. With WPACKET this is
    irrelevant since it will grow automatically.
    
    This issue came up when an attempt was made to send a very large
    certificate_authorities extension in the ClientHello.
    
    We should just remove the limit.
    
    Reviewed-by: Paul Dale <paul.dale at oracle.com>
    Reviewed-by: Viktor Dukhovni <viktor at openssl.org>
    (Merged from https://github.com/openssl/openssl/pull/7424)

-----------------------------------------------------------------------

Summary of changes:
 ssl/statem/statem_clnt.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/ssl/statem/statem_clnt.c b/ssl/statem/statem_clnt.c
index 3b6cbb7..53bc5ef 100644
--- a/ssl/statem/statem_clnt.c
+++ b/ssl/statem/statem_clnt.c
@@ -1112,13 +1112,6 @@ int tls_construct_client_hello(SSL *s, WPACKET *pkt)
     SSL_SESSION *sess = s->session;
     unsigned char *session_id;
 
-    if (!WPACKET_set_max_size(pkt, SSL3_RT_MAX_PLAIN_LENGTH)) {
-        /* Should not happen */
-        SSLfatal(s, SSL_AD_INTERNAL_ERROR,
-                 SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
-        return 0;
-    }
-
     /* Work out what SSL/TLS/DTLS version to use */
     protverr = ssl_set_client_hello_version(s);
     if (protverr != 0) {