tls_validate_record_header(): Check for all HTTP methods

The change checks for all HTTP methods in ssl_record, not only GET, POST,
PUT and HEAD. (additionally PATCH, DELETE, OPTIONS and TRACE)

CLA: trivial

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26968)

diff --git a/ssl/record/methods/tlsany_meth.c b/ssl/record/methods/tlsany_meth.c
index 3f73f9ebdd81bd4f0cb38b7a5f18abd6269cfb9e..38d74807140e2da3c5aafc8bf8433cb2103a6902 100644 (file)
--- a/ssl/record/methods/tlsany_meth.c
+++ b/ssl/record/methods/tlsany_meth.c
@@ -67,6 +67,10 @@ static int tls_validate_record_header(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *rec)
                     if (HAS_PREFIX((char *)p, "GET ") ||
                         HAS_PREFIX((char *)p, "POST ") ||
                         HAS_PREFIX((char *)p, "HEAD ") ||
+                        HAS_PREFIX((char *)p, "PATCH") ||
+                        HAS_PREFIX((char *)p, "OPTIO") ||
+                        HAS_PREFIX((char *)p, "DELET") ||
+                        HAS_PREFIX((char *)p, "TRACE") ||
                         HAS_PREFIX((char *)p, "PUT ")) {
                         RLAYERfatal(rl, SSL_AD_NO_ALERT, SSL_R_HTTP_REQUEST);
                         return 0;