lunarmodules / copas / 30305613508

85%

Build Type

push

github

Committed by Tieske

Commit Message

fix(tls): reject sslparams tables that silently disable TLS

normalize_sslt() detected the current {wrap=, sni=} table format by
checking for the legacy 'mode'/'protocol' keys, so any table lacking
those (an empty table, or one with unrelated/misspelled keys) fell
into the "current format" branch and both wrap and sni silently
defaulted to false, identical to passing nil. Since a doc-comment
claimed an empty table meant "TLS with defaults" (no such defaults
exist -- a certificate is mandatory), following that comment produced
a plaintext socket with no error.

Detection is now based on the presence of the 'wrap'/'sni' keys
themselves. Anything without them (empty table, garbage keys, or a
genuine legacy flat luasec-context table) is passed straight through
as 'wrap' parameters, which LuaSec validates and errors on when a
handshake is actually attempted -- so this can no longer fail open
into silent plaintext.

Adds tests/tls-params.lua covering all normalization shapes: no
params, empty/garbage tables, the legacy flat table, and the current
{wrap=, sni=} table.

Fixes #210

Coverage Stats

3 of 3 new or added lines in 1 file covered. (100.0%)

48 existing lines in 1 file now uncovered.

1472 of 1730 relevant lines covered (85.09%)

57213.92 hits per line