diff options
| author | Matt Caswell <matt@openssl.org> | 2017-02-03 14:06:20 +0000 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2017-02-16 09:39:06 +0000 |
| commit | 4ad93618d26a3ea23d36ad5498ff4f59eff3a4d2 (patch) | |
| tree | cf50c7a4eaaf7620c3decf0d116d5c0b08523e1b /ssl/ssl_locl.h | |
| parent | 9c5a691d578a4debfd6ecacc030a85900906bf0d (diff) | |
Don't change the state of the ETM flags until CCS processing
Changing the ciphersuite during a renegotiation can result in a crash
leading to a DoS attack. ETM has not been implemented in 1.1.0 for DTLS
so this is TLS only.
The problem is caused by changing the flag indicating whether to use ETM
or not immediately on negotiation of ETM, rather than at CCS. Therefore,
during a renegotiation, if the ETM state is changing (usually due to a
change of ciphersuite), then an error/crash will occur.
Due to the fact that there are separate CCS messages for read and write
we actually now need two flags to determine whether to use ETM or not.
CVE-2017-3733
Reviewed-by: Richard Levitte <levitte@openssl.org>
Diffstat (limited to 'ssl/ssl_locl.h')
| -rw-r--r-- | ssl/ssl_locl.h | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index 1586a46f63..08de52eea2 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -378,7 +378,8 @@ # define SSL_CLIENT_USE_SIGALGS(s) \ SSL_CLIENT_USE_TLS1_2_CIPHERS(s) -# define SSL_USE_ETM(s) (s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC) +# define SSL_READ_ETM(s) (s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC_READ) +# define SSL_WRITE_ETM(s) (s->s3->flags & TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE) /* Mostly for SSLv3 */ # define SSL_PKEY_RSA_ENC 0 @@ -1110,6 +1111,10 @@ struct ssl_st { */ unsigned char *alpn_client_proto_list; unsigned alpn_client_proto_list_len; + + /* Set to one if we have negotiated ETM */ + int tlsext_use_etm; + /*- * 1 if we are renegotiating. * 2 if we are a server and are inside a handshake |