{"action":"created","comment":{"url":"https://api.github.com/repos/ARMmbed/mbedtls/pulls/comments/201639244","pull_request_review_id":136177753,"id":201639244,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIwMTYzOTI0NA==","diff_hunk":"@@ -3888,6 +3888,20 @@ run_test    \"Small packet TLS 1.2 AEAD shorter tag\" \\\n             0 \\\n             -s \"Read from client: 1 bytes read\"\n \n+# Test for zero-length application data messages with CBC\n+# (using a CBC cipher here causes a zero length application data\n+# message to be sent (16 padding bytes.) This should be ignored\n+# by mbedTLS and not returned as data to the caller\n+#\n+# (The actual bad data is 16 repeated 0x0f bytes, which can't\n+# be matched by cross-platform grep.)","path":"tests/ssl-opt.sh","position":10,"original_position":10,"commit_id":"267adf1271860ab5b17b89c70219a1665057c922","original_commit_id":"267adf1271860ab5b17b89c70219a1665057c922","user":{"login":"mpg","id":60640,"node_id":"MDQ6VXNlcjYwNjQw","avatar_url":"https://avatars0.githubusercontent.com/u/60640?v=4","gravatar_id":"","url":"https://api.github.com/users/mpg","html_url":"https://github.com/mpg","followers_url":"https://api.github.com/users/mpg/followers","following_url":"https://api.github.com/users/mpg/following{/other_user}","gists_url":"https://api.github.com/users/mpg/gists{/gist_id}","starred_url":"https://api.github.com/users/mpg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpg/subscriptions","organizations_url":"https://api.github.com/users/mpg/orgs","repos_url":"https://api.github.com/users/mpg/repos","events_url":"https://api.github.com/users/mpg/events{/privacy}","received_events_url":"https://api.github.com/users/mpg/received_events","type":"User","site_admin":false},"body":"Actually I changed my mind. Rather than relying on a specific OpenSSL version, it seems more robust to just test with ourselves, as @andresag01 made possible with #1852. So I would now suggest removing the test from this PR, as the test will be added in #1852 (to be merge right after this one).","created_at":"2018-07-11T10:23:30Z","updated_at":"2018-07-11T10:23:31Z","html_url":"https://github.com/ARMmbed/mbedtls/pull/1835#discussion_r201639244","pull_request_url":"https://api.github.com/repos/ARMmbed/mbedtls/pulls/1835","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/ARMmbed/mbedtls/pulls/comments/201639244"},"html":{"href":"https://github.com/ARMmbed/mbedtls/pull/1835#discussion_r201639244"},"pull_request":{"href":"https://api.github.com/repos/ARMmbed/mbedtls/pulls/1835"}},"in_reply_to_id":200576990},"pull_request":{"url":"https://api.github.com/repos/ARMmbed/mbedtls/pulls/1835","id":199671992,"node_id":"MDExOlB1bGxSZXF1ZXN0MTk5NjcxOTky","html_url":"https://github.com/ARMmbed/mbedtls/pull/1835","diff_url":"https://github.com/ARMmbed/mbedtls/pull/1835.diff","patch_url":"https://github.com/ARMmbed/mbedtls/pull/1835.patch","issue_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/1835","number":1835,"state":"open","locked":false,"title":"Fix CBC mode decrypting an empty block as padding bytes","user":{"login":"projectgus","id":205573,"node_id":"MDQ6VXNlcjIwNTU3Mw==","avatar_url":"https://avatars1.githubusercontent.com/u/205573?v=4","gravatar_id":"","url":"https://api.github.com/users/projectgus","html_url":"https://github.com/projectgus","followers_url":"https://api.github.com/users/projectgus/followers","following_url":"https://api.github.com/users/projectgus/following{/other_user}","gists_url":"https://api.github.com/users/projectgus/gists{/gist_id}","starred_url":"https://api.github.com/users/projectgus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/projectgus/subscriptions","organizations_url":"https://api.github.com/users/projectgus/orgs","repos_url":"https://api.github.com/users/projectgus/repos","events_url":"https://api.github.com/users/projectgus/events{/privacy}","received_events_url":"https://api.github.com/users/projectgus/received_events","type":"User","site_admin":false},"body":"## Description\r\n\r\nTest and fix for the issue described in #1632 : When CBC mode is used, a zero length TLS application data message (allowed by the standard and sometimes sent by openssl) would incorrectly decrypt as a full block of padding.\r\n\r\nThis PR includes one commit with this fix (and a unit test). Plus two more commits to check for undersized messages:\r\n\r\n* Explicitly check for Alert messages less than 2 bytes (always invalid).\r\n* Zero length messages (except for application data) are explicitly prohibited in TLS v1.2. This check is largely redundant as I think all zero length messages will be treated as invalid by checks in the message hander logic. I almost didn't add this, please let me know if you think it's unnecessary.\r\n\r\nHappy to split the short message checks into a separate PR if that's preferred, or drop them if they're redundant.\r\n\r\n## Status\r\n\r\nREADY\r\n\r\n## Requires Backporting\r\n\r\nYes? Please advise.\r\n\r\n## Migrations\r\n\r\nNO\r\n\r\n## Additional comments\r\n\r\nI don't believe this PR changes any timing in CBC mode.\r\n\r\nSubmission is from Espressif Systems and falls under corporate CLA..\r\n\r\n## Todos\r\n- [x] Tests\r\n- [ ] Changelog updated\r\n- [ ] Backported\r\n\r\n## Steps to test or reproduce\r\n\r\nIssue #1632 gives an openssl s_server command line which works. Same command line is used to create the unit test in the PR.","created_at":"2018-07-06T07:57:08Z","updated_at":"2018-07-11T10:23:31Z","closed_at":null,"merged_at":null,"merge_commit_sha":"600c7c9924f6a61b27bd43a39c705e80d9cceabb","assignee":{"login":"mpg","id":60640,"node_id":"MDQ6VXNlcjYwNjQw","avatar_url":"https://avatars0.githubusercontent.com/u/60640?v=4","gravatar_id":"","url":"https://api.github.com/users/mpg","html_url":"https://github.com/mpg","followers_url":"https://api.github.com/users/mpg/followers","following_url":"https://api.github.com/users/mpg/following{/other_user}","gists_url":"https://api.github.com/users/mpg/gists{/gist_id}","starred_url":"https://api.github.com/users/mpg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpg/subscriptions","organizations_url":"https://api.github.com/users/mpg/orgs","repos_url":"https://api.github.com/users/mpg/repos","events_url":"https://api.github.com/users/mpg/events{/privacy}","received_events_url":"https://api.github.com/users/mpg/received_events","type":"User","site_admin":false},"assignees":[{"login":"mpg","id":60640,"node_id":"MDQ6VXNlcjYwNjQw","avatar_url":"https://avatars0.githubusercontent.com/u/60640?v=4","gravatar_id":"","url":"https://api.github.com/users/mpg","html_url":"https://github.com/mpg","followers_url":"https://api.github.com/users/mpg/followers","following_url":"https://api.github.com/users/mpg/following{/other_user}","gists_url":"https://api.github.com/users/mpg/gists{/gist_id}","starred_url":"https://api.github.com/users/mpg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mpg/subscriptions","organizations_url":"https://api.github.com/users/mpg/orgs","repos_url":"https://api.github.com/users/mpg/repos","events_url":"https://api.github.com/users/mpg/events{/privacy}","received_events_url":"https://api.github.com/users/mpg/received_events","type":"User","site_admin":false}],"requested_reviewers":[{"login":"andresag01","id":3746901,"node_id":"MDQ6VXNlcjM3NDY5MDE=","avatar_url":"https://avatars3.githubusercontent.com/u/3746901?v=4","gravatar_id":"","url":"https://api.github.com/users/andresag01","html_url":"https://github.com/andresag01","followers_url":"https://api.github.com/users/andresag01/followers","following_url":"https://api.github.com/users/andresag01/following{/other_user}","gists_url":"https://api.github.com/users/andresag01/gists{/gist_id}","starred_url":"https://api.github.com/users/andresag01/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andresag01/subscriptions","organizations_url":"https://api.github.com/users/andresag01/orgs","repos_url":"https://api.github.com/users/andresag01/repos","events_url":"https://api.github.com/users/andresag01/events{/privacy}","received_events_url":"https://api.github.com/users/andresag01/received_events","type":"User","site_admin":false}],"requested_teams":[],"labels":[{"id":278176777,"node_id":"MDU6TGFiZWwyNzgxNzY3Nzc=","url":"https://api.github.com/repos/ARMmbed/mbedtls/labels/CLA%20valid","name":"CLA valid","color":"bfdadc","default":false},{"id":19280384,"node_id":"MDU6TGFiZWwxOTI4MDM4NA==","url":"https://api.github.com/repos/ARMmbed/mbedtls/labels/bug","name":"bug","color":"d93f0b","default":true},{"id":937147638,"node_id":"MDU6TGFiZWw5MzcxNDc2Mzg=","url":"https://api.github.com/repos/ARMmbed/mbedtls/labels/component:%20TLS","name":"component: TLS","color":"CEE3F6","default":false},{"id":875960996,"node_id":"MDU6TGFiZWw4NzU5NjA5OTY=","url":"https://api.github.com/repos/ARMmbed/mbedtls/labels/needs%20backports","name":"needs backports","color":"fbca04","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/ARMmbed/mbedtls/pulls/1835/commits","review_comments_url":"https://api.github.com/repos/ARMmbed/mbedtls/pulls/1835/comments","review_comment_url":"https://api.github.com/repos/ARMmbed/mbedtls/pulls/comments{/number}","comments_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/1835/comments","statuses_url":"https://api.github.com/repos/ARMmbed/mbedtls/statuses/267adf1271860ab5b17b89c70219a1665057c922","head":{"label":"espressif:bugfix/cbc_mode_allow_empty_application_data-upstream","ref":"bugfix/cbc_mode_allow_empty_application_data-upstream","sha":"267adf1271860ab5b17b89c70219a1665057c922","user":{"login":"espressif","id":9460735,"node_id":"MDEyOk9yZ2FuaXphdGlvbjk0NjA3MzU=","avatar_url":"https://avatars2.githubusercontent.com/u/9460735?v=4","gravatar_id":"","url":"https://api.github.com/users/espressif","html_url":"https://github.com/espressif","followers_url":"https://api.github.com/users/espressif/followers","following_url":"https://api.github.com/users/espressif/following{/other_user}","gists_url":"https://api.github.com/users/espressif/gists{/gist_id}","starred_url":"https://api.github.com/users/espressif/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/espressif/subscriptions","organizations_url":"https://api.github.com/users/espressif/orgs","repos_url":"https://api.github.com/users/espressif/repos","events_url":"https://api.github.com/users/espressif/events{/privacy}","received_events_url":"https://api.github.com/users/espressif/received_events","type":"Organization","site_admin":false},"repo":{"id":132632437,"node_id":"MDEwOlJlcG9zaXRvcnkxMzI2MzI0Mzc=","name":"mbedtls","full_name":"espressif/mbedtls","owner":{"login":"espressif","id":9460735,"node_id":"MDEyOk9yZ2FuaXphdGlvbjk0NjA3MzU=","avatar_url":"https://avatars2.githubusercontent.com/u/9460735?v=4","gravatar_id":"","url":"https://api.github.com/users/espressif","html_url":"https://github.com/espressif","followers_url":"https://api.github.com/users/espressif/followers","following_url":"https://api.github.com/users/espressif/following{/other_user}","gists_url":"https://api.github.com/users/espressif/gists{/gist_id}","starred_url":"https://api.github.com/users/espressif/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/espressif/subscriptions","organizations_url":"https://api.github.com/users/espressif/orgs","repos_url":"https://api.github.com/users/espressif/repos","events_url":"https://api.github.com/users/espressif/events{/privacy}","received_events_url":"https://api.github.com/users/espressif/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/espressif/mbedtls","description":"An open source, portable, easy to use, readable and flexible SSL library","fork":true,"url":"https://api.github.com/repos/espressif/mbedtls","forks_url":"https://api.github.com/repos/espressif/mbedtls/forks","keys_url":"https://api.github.com/repos/espressif/mbedtls/keys{/key_id}","collaborators_url":"https://api.github.com/repos/espressif/mbedtls/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/espressif/mbedtls/teams","hooks_url":"https://api.github.com/repos/espressif/mbedtls/hooks","issue_events_url":"https://api.github.com/repos/espressif/mbedtls/issues/events{/number}","events_url":"https://api.github.com/repos/espressif/mbedtls/events","assignees_url":"https://api.github.com/repos/espressif/mbedtls/assignees{/user}","branches_url":"https://api.github.com/repos/espressif/mbedtls/branches{/branch}","tags_url":"https://api.github.com/repos/espressif/mbedtls/tags","blobs_url":"https://api.github.com/repos/espressif/mbedtls/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/espressif/mbedtls/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/espressif/mbedtls/git/refs{/sha}","trees_url":"https://api.github.com/repos/espressif/mbedtls/git/trees{/sha}","statuses_url":"https://api.github.com/repos/espressif/mbedtls/statuses/{sha}","languages_url":"https://api.github.com/repos/espressif/mbedtls/languages","stargazers_url":"https://api.github.com/repos/espressif/mbedtls/stargazers","contributors_url":"https://api.github.com/repos/espressif/mbedtls/contributors","subscribers_url":"https://api.github.com/repos/espressif/mbedtls/subscribers","subscription_url":"https://api.github.com/repos/espressif/mbedtls/subscription","commits_url":"https://api.github.com/repos/espressif/mbedtls/commits{/sha}","git_commits_url":"https://api.github.com/repos/espressif/mbedtls/git/commits{/sha}","comments_url":"https://api.github.com/repos/espressif/mbedtls/comments{/number}","issue_comment_url":"https://api.github.com/repos/espressif/mbedtls/issues/comments{/number}","contents_url":"https://api.github.com/repos/espressif/mbedtls/contents/{+path}","compare_url":"https://api.github.com/repos/espressif/mbedtls/compare/{base}...{head}","merges_url":"https://api.github.com/repos/espressif/mbedtls/merges","archive_url":"https://api.github.com/repos/espressif/mbedtls/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/espressif/mbedtls/downloads","issues_url":"https://api.github.com/repos/espressif/mbedtls/issues{/number}","pulls_url":"https://api.github.com/repos/espressif/mbedtls/pulls{/number}","milestones_url":"https://api.github.com/repos/espressif/mbedtls/milestones{/number}","notifications_url":"https://api.github.com/repos/espressif/mbedtls/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/espressif/mbedtls/labels{/name}","releases_url":"https://api.github.com/repos/espressif/mbedtls/releases{/id}","deployments_url":"https://api.github.com/repos/espressif/mbedtls/deployments","created_at":"2018-05-08T15:57:12Z","updated_at":"2018-05-08T15:57:18Z","pushed_at":"2018-07-06T07:41:57Z","git_url":"git://github.com/espressif/mbedtls.git","ssh_url":"git@github.com:espressif/mbedtls.git","clone_url":"https://github.com/espressif/mbedtls.git","svn_url":"https://github.com/espressif/mbedtls","homepage":"https://tls.mbed.org","size":28739,"stargazers_count":0,"watchers_count":0,"language":"C","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"other","name":"Other","spdx_id":null,"url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"development"}},"base":{"label":"ARMmbed:development","ref":"development","sha":"1ab9b5714852c6810c0a0bfd8c3b5c60a9a15482","user":{"login":"ARMmbed","id":8916057,"node_id":"MDEyOk9yZ2FuaXphdGlvbjg5MTYwNTc=","avatar_url":"https://avatars3.githubusercontent.com/u/8916057?v=4","gravatar_id":"","url":"https://api.github.com/users/ARMmbed","html_url":"https://github.com/ARMmbed","followers_url":"https://api.github.com/users/ARMmbed/followers","following_url":"https://api.github.com/users/ARMmbed/following{/other_user}","gists_url":"https://api.github.com/users/ARMmbed/gists{/gist_id}","starred_url":"https://api.github.com/users/ARMmbed/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ARMmbed/subscriptions","organizations_url":"https://api.github.com/users/ARMmbed/orgs","repos_url":"https://api.github.com/users/ARMmbed/repos","events_url":"https://api.github.com/users/ARMmbed/events{/privacy}","received_events_url":"https://api.github.com/users/ARMmbed/received_events","type":"Organization","site_admin":false},"repo":{"id":6687936,"node_id":"MDEwOlJlcG9zaXRvcnk2Njg3OTM2","name":"mbedtls","full_name":"ARMmbed/mbedtls","owner":{"login":"ARMmbed","id":8916057,"node_id":"MDEyOk9yZ2FuaXphdGlvbjg5MTYwNTc=","avatar_url":"https://avatars3.githubusercontent.com/u/8916057?v=4","gravatar_id":"","url":"https://api.github.com/users/ARMmbed","html_url":"https://github.com/ARMmbed","followers_url":"https://api.github.com/users/ARMmbed/followers","following_url":"https://api.github.com/users/ARMmbed/following{/other_user}","gists_url":"https://api.github.com/users/ARMmbed/gists{/gist_id}","starred_url":"https://api.github.com/users/ARMmbed/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ARMmbed/subscriptions","organizations_url":"https://api.github.com/users/ARMmbed/orgs","repos_url":"https://api.github.com/users/ARMmbed/repos","events_url":"https://api.github.com/users/ARMmbed/events{/privacy}","received_events_url":"https://api.github.com/users/ARMmbed/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/ARMmbed/mbedtls","description":"An open source, portable, easy to use, readable and flexible SSL library","fork":false,"url":"https://api.github.com/repos/ARMmbed/mbedtls","forks_url":"https://api.github.com/repos/ARMmbed/mbedtls/forks","keys_url":"https://api.github.com/repos/ARMmbed/mbedtls/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ARMmbed/mbedtls/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ARMmbed/mbedtls/teams","hooks_url":"https://api.github.com/repos/ARMmbed/mbedtls/hooks","issue_events_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/events{/number}","events_url":"https://api.github.com/repos/ARMmbed/mbedtls/events","assignees_url":"https://api.github.com/repos/ARMmbed/mbedtls/assignees{/user}","branches_url":"https://api.github.com/repos/ARMmbed/mbedtls/branches{/branch}","tags_url":"https://api.github.com/repos/ARMmbed/mbedtls/tags","blobs_url":"https://api.github.com/repos/ARMmbed/mbedtls/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ARMmbed/mbedtls/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ARMmbed/mbedtls/git/refs{/sha}","trees_url":"https://api.github.com/repos/ARMmbed/mbedtls/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ARMmbed/mbedtls/statuses/{sha}","languages_url":"https://api.github.com/repos/ARMmbed/mbedtls/languages","stargazers_url":"https://api.github.com/repos/ARMmbed/mbedtls/stargazers","contributors_url":"https://api.github.com/repos/ARMmbed/mbedtls/contributors","subscribers_url":"https://api.github.com/repos/ARMmbed/mbedtls/subscribers","subscription_url":"https://api.github.com/repos/ARMmbed/mbedtls/subscription","commits_url":"https://api.github.com/repos/ARMmbed/mbedtls/commits{/sha}","git_commits_url":"https://api.github.com/repos/ARMmbed/mbedtls/git/commits{/sha}","comments_url":"https://api.github.com/repos/ARMmbed/mbedtls/comments{/number}","issue_comment_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues/comments{/number}","contents_url":"https://api.github.com/repos/ARMmbed/mbedtls/contents/{+path}","compare_url":"https://api.github.com/repos/ARMmbed/mbedtls/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ARMmbed/mbedtls/merges","archive_url":"https://api.github.com/repos/ARMmbed/mbedtls/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ARMmbed/mbedtls/downloads","issues_url":"https://api.github.com/repos/ARMmbed/mbedtls/issues{/number}","pulls_url":"https://api.github.com/repos/ARMmbed/mbedtls/pulls{/number}","milestones_url":"https://api.github.com/repos/ARMmbed/mbedtls/milestones{/number}","notifications_url":"https://api.github.com/repos/ARMmbed/mbedtls/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ARMmbed/mbedtls/labels{/name}","releases_url":"https://api.github.com/repos/ARMmbed/mbedtls/releases{/id}","deployments_url":"https://api.github.com/repos/ARMmbed/mbedtls/deployments","created_at":"2012-11-14T13:13:13Z","updated_at":"2018-07-11T09:08:07Z","pushed_at":"2018-07-11T09:25:17Z","git_url":"git://github.com/ARMmbed/mbedtls.git","ssh_url":"git@github.com:ARMmbed/mbedtls.git","clone_url":"https://github.com/ARMmbed/mbedtls.git","svn_url":"https://github.com/ARMmbed/mbedtls","homepage":"https://tls.mbed.org","size":29061,"stargazers_count":1447,"watchers_count":1447,"language":"C","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":888,"mirror_url":null,"archived":false,"open_issues_count":498,"license":{"key":"other","name":"Other","spdx_id":null,"url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":888,"open_issues":498,"watchers":1447,"default_branch":"development"}},"_links":{"self":{"href":"https://api.github.com/repos/ARMmbed/mbedtls/pulls/1835"},"html":{"href":"https://github.com/ARMmbed/mbedtls/pull/1835"},"issue":{"href":"https://api.github.com/repos/ARMmbed/mbedtls/issues/1835"},"comments":{"href":"https://api.github.com/repos/ARMmbed/mbedtls/issues/1835/comments"},"review_comments":{"href":"https://api.github.com/repos/ARMmbed/mbedtls/pulls/1835/comments"},"review_comment":{"href":"https://api.github.com/repos/ARMmbed/mbedtls/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/ARMmbed/mbedtls/pulls/1835/commits"},"statuses":{"href":"https://api.github.com/repos/ARMmbed/mbedtls/statuses/267adf1271860ab5b17b89c70219a1665057c922"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"mpg"}}