diff options
author | Tomas Mraz <tomas@openssl.org> | 2023-06-12 18:16:35 +0200 |
---|---|---|
committer | Tomas Mraz <tomas@openssl.org> | 2023-06-23 14:31:45 +0200 |
commit | a02571a02473889d13fe7996e0d2d052328f3199 (patch) | |
tree | 75640dea8f81108e88292cfbb8b4b26e066da959 /ssl | |
parent | ff88545e02ab48a52952350c52013cf765455dd3 (diff) |
Support SSL_OP_CLEANSE_PLAINTEXT on QUIC streams
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21182)
Diffstat (limited to 'ssl')
-rw-r--r-- | ssl/quic/quic_channel.c | 9 | ||||
-rw-r--r-- | ssl/quic/quic_impl.c | 18 | ||||
-rw-r--r-- | ssl/quic/quic_rstream.c | 9 | ||||
-rw-r--r-- | ssl/quic/quic_sf_list.c | 7 | ||||
-rw-r--r-- | ssl/quic/quic_sstream.c | 2 | ||||
-rw-r--r-- | ssl/ssl_lib.c | 11 |
6 files changed, 49 insertions, 7 deletions
diff --git a/ssl/quic/quic_channel.c b/ssl/quic/quic_channel.c index 586441f138..53d86eac98 100644 --- a/ssl/quic/quic_channel.c +++ b/ssl/quic/quic_channel.c @@ -2696,8 +2696,13 @@ static int ch_init_new_stream(QUIC_CHANNEL *ch, QUIC_STREAM *qs, if (can_send && (qs->sstream = ossl_quic_sstream_new(INIT_APP_BUF_LEN)) == NULL) goto err; - if (can_recv && (qs->rstream = ossl_quic_rstream_new(NULL, NULL, 0)) == NULL) - goto err; + if (can_recv) { + if ((qs->rstream = ossl_quic_rstream_new(NULL, NULL, 0)) == NULL) + goto err; + ossl_quic_rstream_set_cleanse(qs->rstream, + (ch->tls->ctx->options + & SSL_OP_CLEANSE_PLAINTEXT) != 0); + } /* TXFC */ if (!ossl_quic_txfc_init(&qs->txfc, &ch->conn_txfc)) diff --git a/ssl/quic/quic_impl.c b/ssl/quic/quic_impl.c index 4f379e32ed..d2a79feb61 100644 --- a/ssl/quic/quic_impl.c +++ b/ssl/quic/quic_impl.c @@ -2798,6 +2798,24 @@ const SSL_CIPHER *ossl_quic_get_cipher(unsigned int u) return NULL; } +int ossl_quic_set_ssl_op(SSL *ssl, uint64_t op) +{ + QCTX ctx; + + if (!expect_quic_with_stream_lock(ssl, /*remote_init=*/-1, &ctx)) + return 0; + + if (ctx.xso->stream == NULL || ctx.xso->stream->rstream == NULL) + goto out; + + ossl_quic_rstream_set_cleanse(ctx.xso->stream->rstream, + (op & SSL_OP_CLEANSE_PLAINTEXT) != 0); + + out: + quic_unlock(ctx.qc); + return 1; +} + /* * Internal Testing APIs * ===================== diff --git a/ssl/quic/quic_rstream.c b/ssl/quic/quic_rstream.c index b35bd983af..80970b084f 100644 --- a/ssl/quic/quic_rstream.c +++ b/ssl/quic/quic_rstream.c @@ -120,7 +120,7 @@ static int read_internal(QUIC_RSTREAM *qrs, unsigned char *buf, size_t size, if (drop && offset != 0) { ret = ossl_sframe_list_drop_frames(&qrs->fl, offset); - ring_buf_cpop_range(&qrs->rbuf, 0, offset - 1); + ring_buf_cpop_range(&qrs->rbuf, 0, offset - 1, qrs->fl.cleanse); } if (ret) { @@ -245,7 +245,7 @@ int ossl_quic_rstream_release_record(QUIC_RSTREAM *qrs, size_t read_len) return 0; if (offset > 0) - ring_buf_cpop_range(&qrs->rbuf, 0, offset - 1); + ring_buf_cpop_range(&qrs->rbuf, 0, offset - 1, qrs->fl.cleanse); if (qrs->rxfc != NULL) { OSSL_TIME rtt = get_rtt(qrs); @@ -286,3 +286,8 @@ int ossl_quic_rstream_resize_rbuf(QUIC_RSTREAM *qrs, size_t rbuf_size) return 1; } + +void ossl_quic_rstream_set_cleanse(QUIC_RSTREAM *qrs, int cleanse) +{ + qrs->fl.cleanse = cleanse; +} diff --git a/ssl/quic/quic_sf_list.c b/ssl/quic/quic_sf_list.c index b53cbc1739..7f3fc9b842 100644 --- a/ssl/quic/quic_sf_list.c +++ b/ssl/quic/quic_sf_list.c @@ -20,6 +20,9 @@ struct stream_frame_st { static void stream_frame_free(SFRAME_LIST *fl, STREAM_FRAME *sf) { + if (fl->cleanse && sf->data != NULL) + OPENSSL_cleanse((unsigned char *)sf->data, + (size_t)(sf->range.end - sf->range.start)); ossl_qrx_pkt_release(sf->pkt); OPENSSL_free(sf); } @@ -295,6 +298,10 @@ int ossl_sframe_list_move_data(SFRAME_LIST *fl, /* data did not fit */ return 0; + if (fl->cleanse) + OPENSSL_cleanse((unsigned char *)sf->data, + (size_t)(sf->range.end - sf->range.start)); + /* release the packet */ sf->data = NULL; ossl_qrx_pkt_release(sf->pkt); diff --git a/ssl/quic/quic_sstream.c b/ssl/quic/quic_sstream.c index 0e15dde51d..5ead14038a 100644 --- a/ssl/quic/quic_sstream.c +++ b/ssl/quic/quic_sstream.c @@ -349,7 +349,7 @@ static void qss_cull(QUIC_SSTREAM *qss) * can only cull contiguous areas at the start of the ring buffer anyway. */ if (h != NULL) - ring_buf_cpop_range(&qss->ring_buf, h->range.start, h->range.end); + ring_buf_cpop_range(&qss->ring_buf, h->range.start, h->range.end, 0); } int ossl_quic_sstream_set_buffer_size(QUIC_SSTREAM *qss, size_t num_bytes) diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c index 1894be7d59..51a78fa383 100644 --- a/ssl/ssl_lib.c +++ b/ssl/ssl_lib.c @@ -5880,10 +5880,17 @@ uint64_t SSL_CTX_set_options(SSL_CTX *ctx, uint64_t op) uint64_t SSL_set_options(SSL *s, uint64_t op) { - SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); + SSL_CONNECTION *sc; OSSL_PARAM options[2], *opts = options; - if (sc == NULL) +#ifndef OPENSSL_NO_QUIC + if (IS_QUIC(s) && ossl_quic_set_ssl_op(s, op)) + /* Handled by QUIC, return as set */ + return op; +#endif + + sc = SSL_CONNECTION_FROM_SSL(s); + if (sc == NULL) return 0; sc->options |= op; |