diff options
| author | Matt Caswell <matt@openssl.org> | 2017-02-03 14:06:20 +0000 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2017-02-16 09:39:06 +0000 |
| commit | 4ad93618d26a3ea23d36ad5498ff4f59eff3a4d2 (patch) | |
| tree | cf50c7a4eaaf7620c3decf0d116d5c0b08523e1b /include | |
| parent | 9c5a691d578a4debfd6ecacc030a85900906bf0d (diff) | |
Don't change the state of the ETM flags until CCS processing
Changing the ciphersuite during a renegotiation can result in a crash
leading to a DoS attack. ETM has not been implemented in 1.1.0 for DTLS
so this is TLS only.
The problem is caused by changing the flag indicating whether to use ETM
or not immediately on negotiation of ETM, rather than at CCS. Therefore,
during a renegotiation, if the ETM state is changing (usually due to a
change of ciphersuite), then an error/crash will occur.
Due to the fact that there are separate CCS messages for read and write
we actually now need two flags to determine whether to use ETM or not.
CVE-2017-3733
Reviewed-by: Richard Levitte <levitte@openssl.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/openssl/ssl3.h | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/include/openssl/ssl3.h b/include/openssl/ssl3.h index aca1922306..4ca434e760 100644 --- a/include/openssl/ssl3.h +++ b/include/openssl/ssl3.h @@ -264,11 +264,14 @@ extern "C" { # define TLS1_FLAGS_SKIP_CERT_VERIFY 0x0010 /* Set if we encrypt then mac instead of usual mac then encrypt */ -# define TLS1_FLAGS_ENCRYPT_THEN_MAC 0x0100 +# define TLS1_FLAGS_ENCRYPT_THEN_MAC_READ 0x0100 +# define TLS1_FLAGS_ENCRYPT_THEN_MAC TLS1_FLAGS_ENCRYPT_THEN_MAC_READ /* Set if extended master secret extension received from peer */ # define TLS1_FLAGS_RECEIVED_EXTMS 0x0200 +# define TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE 0x0400 + # define SSL3_MT_HELLO_REQUEST 0 # define SSL3_MT_CLIENT_HELLO 1 # define SSL3_MT_SERVER_HELLO 2 |