Description
Security issue notifications
If you discover a potential security issue in s2n we ask that you notify
AWS Security via our vulnerability reporting page. Please do not create a public github issue.
Problem:
If s2n_config_set_session_cache_onoff() is called and the user has not set the three caching callbacks already, session caching will not be turned on. This is weird behavior; I'm not sure if this was a miss or if it is a legitimate decision made to try to prevent a caching attempt with no caching callbacks. But the user doesn't get any feedback on whether or not caching was turned on, so that makes this code a sharp edge.
https://github.com/aws/s2n-tls/blob/main/tls/s2n_config.c#L785.
Solution:
Probably fix this so you don't have to set the callbacks before calling this function.
- Does this change what S2N sends over the wire? If yes, explain.
- Does this change any public APIs? If yes, explain.
- Which versions of TLS will this impact?
Requirements / Acceptance Criteria:
What must a solution address in order to solve the problem? How do we know the solution is complete?
- RFC links: Links to relevant RFC(s)
- Related Issues: Link any relevant issues
- Will the Usage Guide or other documentation need to be updated?
- Testing: How will this change be tested? Call out new integration tests, functional tests, or particularly interesting/important unit tests.
- Will this change trigger SAW changes? Changes to the state machine, the s2n_handshake_io code that controls state transitions, the DRBG, or the corking/uncorking logic could trigger SAW failures.
- Should this change be fuzz tested? Will it handle untrusted input? Create a separate issue to track the fuzzing work.
Out of scope:
Is there anything the solution will intentionally NOT address?
Activity