Fix TLSX_Parse to check dup ECH

Author: embhorn

src/tls.c

@@ -17043,6 +17043,9 @@ int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length, byte msgType,
         #ifdef WOLFSSL_QUIC
             || (type == TLSX_KEY_QUIC_TP_PARAMS_DRAFT)
         #endif
+        #if defined(WOLFSSL_TLS13) && defined(HAVE_ECH)
+            || (type == TLSX_ECH)
+        #endif
         #if defined(WOLFSSL_TLS13) && defined(WOLFSSL_DUAL_ALG_CERTS)
             || (type == TLSX_CKS)
         #endif

tests/api/test_tls13.c

@@ -2922,6 +2922,108 @@ int test_tls13_duplicate_extension(void)
 }
 
 
+#if defined(WOLFSSL_TLS13) && defined(HAVE_ECH) && \
+    !defined(NO_WOLFSSL_SERVER) && !defined(NO_FILESYSTEM) && \
+    (!defined(NO_RSA) || defined(HAVE_ECC))
+static int DupEchSend(WOLFSSL* ssl, char* buf, int sz, void* ctx)
+{
+	(void)ssl;
+	(void)buf;
+	(void)sz;
+	(void)ctx;
+
+	return sz;
+}
+static int DupEchRecv(WOLFSSL* ssl, char* buf, int sz, void* ctx)
+{
+	WOLFSSL_BUFFER_INFO* msg = (WOLFSSL_BUFFER_INFO*)ctx;
+	int len = (int)msg->length;
+
+	(void)ssl;
+	(void)sz;
+
+	if (len > sz)
+		len = sz;
+	XMEMCPY(buf, msg->buffer, len);
+	msg->buffer += len;
+	msg->length -= len;
+
+	return len;
+}
+#endif
+
+/* Test detection of duplicate ECH extension (type 0xfe0d) in ClientHello.
+ * ECH has a semaphore mapping in TLSX_ToSemaphore() and needs to be included
+ * in the duplicate-detection gate in TLSX_Parse(). RFC 8446 section 4.2
+ * requires rejecting messages with duplicate extensions.
+ */
+int test_tls13_duplicate_ech_extension(void)
+{
+	EXPECT_DECLS;
+#if defined(WOLFSSL_TLS13) && defined(HAVE_ECH) && \
+    !defined(NO_WOLFSSL_SERVER) && !defined(NO_FILESYSTEM) && \
+    (!defined(NO_RSA) || defined(HAVE_ECC))
+	/* TLS 1.3 ClientHello with two ECH extensions (type 0xfe0d).
+	 * Extensions block contains: supported_versions + ECH + ECH (dup). */
+	const unsigned char clientHelloDupEch[] = {
+		0x16, 0x03, 0x03, 0x00, 0x40, 0x01, 0x00, 0x00,
+		0x3c, 0x03, 0x03, 0x01, 0x01, 0x01, 0x01, 0x01,
+		0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
+		0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
+		0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
+		0x01, 0x01, 0x01, 0x00, 0x00, 0x02, 0x13, 0x01,
+		0x01, 0x00, 0x00, 0x11, 0x00, 0x2b, 0x00, 0x03,
+		0x02, 0x03, 0x04, 0xfe, 0x0d, 0x00, 0x01, 0x00,
+		0xfe, 0x0d, 0x00, 0x01, 0x00
+	};
+	WOLFSSL_BUFFER_INFO msg;
+	const char* testCertFile;
+	const char* testKeyFile;
+	WOLFSSL_CTX *ctx = NULL;
+	WOLFSSL     *ssl = NULL;
+
+#ifndef NO_RSA
+	testCertFile = svrCertFile;
+	testKeyFile = svrKeyFile;
+#elif defined(HAVE_ECC)
+	testCertFile = eccCertFile;
+	testKeyFile = eccKeyFile;
+#endif
+
+	ExpectNotNull(ctx = wolfSSL_CTX_new(wolfTLSv1_3_server_method()));
+
+	ExpectTrue(wolfSSL_CTX_use_certificate_file(ctx, testCertFile,
+		CERT_FILETYPE));
+	ExpectTrue(wolfSSL_CTX_use_PrivateKey_file(ctx, testKeyFile,
+		CERT_FILETYPE));
+
+	/* Read from 'msg'. */
+	wolfSSL_SetIORecv(ctx, DupEchRecv);
+	/* No where to send to - dummy sender. */
+	wolfSSL_SetIOSend(ctx, DupEchSend);
+
+	ssl = wolfSSL_new(ctx);
+	ExpectNotNull(ssl);
+
+	msg.buffer = (unsigned char*)clientHelloDupEch;
+	msg.length = (unsigned int)sizeof(clientHelloDupEch);
+	wolfSSL_SetIOReadCtx(ssl, &msg);
+
+	ExpectIntNE(wolfSSL_accept(ssl), WOLFSSL_SUCCESS);
+	/* Can return duplicate ext error or socket error if the peer closed
+	 * down while sending alert. */
+	if (wolfSSL_get_error(ssl, 0) != WC_NO_ERR_TRACE(SOCKET_ERROR_E)) {
+		ExpectIntEQ(wolfSSL_get_error(ssl, 0),
+			WC_NO_ERR_TRACE(DUPLICATE_TLS_EXT_E));
+	}
+
+	wolfSSL_free(ssl);
+	wolfSSL_CTX_free(ctx);
+#endif
+	return EXPECT_RESULT();
+}
+
+
 int test_key_share_mismatch(void)
 {
     EXPECT_DECLS;

tests/api/test_tls13.h

@@ -36,6 +36,7 @@ int test_tls13_ch2_different_cs(void);
 int test_tls13_sg_missing(void);
 int test_tls13_ks_missing(void);
 int test_tls13_duplicate_extension(void);
+int test_tls13_duplicate_ech_extension(void);
 int test_key_share_mismatch(void);
 int test_tls13_middlebox_compat_empty_session_id(void);
 int test_tls13_plaintext_alert(void);
@@ -59,6 +60,7 @@ int test_tls13_short_session_ticket(void);
     TEST_DECL_GROUP("tls13", test_tls13_sg_missing),            \
     TEST_DECL_GROUP("tls13", test_tls13_ks_missing),            \
     TEST_DECL_GROUP("tls13", test_tls13_duplicate_extension),   \
+    TEST_DECL_GROUP("tls13", test_tls13_duplicate_ech_extension), \
     TEST_DECL_GROUP("tls13", test_key_share_mismatch),          \
     TEST_DECL_GROUP("tls13", test_tls13_middlebox_compat_empty_session_id), \
     TEST_DECL_GROUP("tls13", test_tls13_plaintext_alert),       \