summaryrefslogtreecommitdiffstats
path: root/ssl/statem
AgeCommit message (Collapse)Author
2024-06-27Add ALPN validation in the clientMatt Caswell
The ALPN protocol selected by the server must be one that we originally advertised. We should verify that it is. Follow on from CVE-2024-5535 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24718)
2024-06-27Correct return values for tls_construct_stoc_next_proto_negMatt Caswell
Return EXT_RETURN_NOT_SENT in the event that we don't send the extension, rather than EXT_RETURN_SENT. This actually makes no difference at all to the current control flow since this return value is ignored in this case anyway. But lets make it correct anyway. Follow on from CVE-2024-5535 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24718)
2024-06-27More correctly handle a selected_len of 0 when processing NPNMatt Caswell
In the case where the NPN callback returns with SSL_TLEXT_ERR_OK, but the selected_len is 0 we should fail. Previously this would fail with an internal_error alert because calling OPENSSL_malloc(selected_len) will return NULL when selected_len is 0. We make this error detection more explicit and return a handshake failure alert. Follow on from CVE-2024-5535 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24718)
2024-06-20Fix handling of max_fragment_length extension for PSKFrederik Wedel-Heinen
A psk session was assumed to be a resumption which failed a check when parsing the max_fragment_length extension hello from the client. Relevant code from PR#18130 which was a suggested fix to the issue was cherry-picked. Fixes #18121 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24513) (cherry picked from commit fa495604516a610d988f02298c8d97a6ac4777bb)
2024-06-04Copyright year updatesTomas Mraz
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-05-14Release pkey_ctx on initialization failureirosay
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24366) (cherry picked from commit 3e9d933882407a0792dc3466ba9a0d53d40677a7)
2024-04-08Fix unconstrained session cache growth in TLSv1.3Matt Caswell
In TLSv1.3 we create a new session object for each ticket that we send. We do this by duplicating the original session. If SSL_OP_NO_TICKET is in use then the new session will be added to the session cache. However, if early data is not in use (and therefore anti-replay protection is being used), then multiple threads could be resuming from the same session simultaneously. If this happens and a problem occurs on one of the threads, then the original session object could be marked as not_resumable. When we duplicate the session object this not_resumable status gets copied into the new session object. The new session object is then added to the session cache even though it is not_resumable. Subsequently, another bug means that the session_id_length is set to 0 for sessions that are marked as not_resumable - even though that session is still in the cache. Once this happens the session can never be removed from the cache. When that object gets to be the session cache tail object the cache never shrinks again and grows indefinitely. CVE-2024-2511 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24044)
2023-11-24Move freeing of an old enc_write_ctx/write_hash to dtls1_clear_sent_bufferMatt Caswell
When we are clearing the sent messages queue we should ensure we free any old enc_write_ctx/write_hash that are no longer in use. Previously this logic was in dtls1_hm_fragment_free() - but this can end up freeing the current enc_write_ctx/write_hash under certain error conditions. Fixes #22664 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2261)
2023-11-24zero data in hm_fragment on allocNeil Horman
if we allocate a new hm_frament in dtls1_buffer_message with dtls1_hm_fragment_new, the returned fragment contains uninitalized data in the msg_header field. If an error then occurs, and we free the fragment, dtls_hm_fragment_free interrogates the msg_header field (which is garbage), and potentially references undefined values, or worse, accidentally references available memory that is not owned, leading to various corruptions. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2261)
2023-11-22Fix a possible use-after-free in custom_exts_freeBernd Edlinger
This may happen when ssl_cert_dup calls custom_exts_copy, where a possible memory allocation error causes custom_exts_free to be called twice: once in the error handling of custom_exts_copy and a second time in the error handling of ssl_cert_dup. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22772) (cherry picked from commit bc0773bbbd4d3ace6957385f1f22a5cda25dc94f)
2023-11-08Fix a possible memory leak in custom_ext_addBernd Edlinger
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22639)
2023-09-19Copyright year updatesRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes
2023-08-04Resolves some magic values that has a hello_retry_request enum type.Frederik Wedel-Heinen
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21636) (cherry picked from commit 5ac7ee4d5a38e4f163ed6a7c9c283d45038625a8)
2023-08-01Copyright year updatesMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-07-17Fix ssl3_do_write() to correctly handle retriesMatt Caswell
A BIO is documented to return -1 on write retry - but sometimes they return 0. ssl3_do_write() was incorrectly handling a 0 response. Fixes #21422 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21435)
2023-06-23Don't ask for an invalid group in an HRRMatt Caswell
If the client sends us a group in a key_share that is in our supported_groups list but is otherwise not suitable (e.g. not compatible with TLSv1.3) we reject it. We should not ask for that same group again in a subsequent HRR. Fixes #21157 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/21163) (cherry picked from commit 7a949ae5f1799a6629cf6deb44ae0f38455a73dd)
2022-12-13Make error reason for disallowed legacy sigalg more specificTomas Mraz
The internal error reason is confusing and indicating an error in OpenSSL and not a configuration problem. Fixes #19867 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19875) (cherry picked from commit 97b8db1af2f71059ecea986e4d12fc6a23699a74)
2022-12-08Fix warnings with unsigned time_tJ.W. Jagersma
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19843)
2022-11-23Cleanup EBCDIC string defintionsTodd Short
Use a single definiton for protocol string defintions. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19122) (cherry picked from commit 44e47328178328198018c23e6918884af5e8ce4b)
2022-11-21Remove duplicated #include headersJHH20
CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18220) (cherry picked from commit e257d3e76ffb848b7607b04057257323dc51c3b4)
2022-11-09Fix typosDimitris Apostolou
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17392) (cherry picked from commit e304aa87b35fac5ea97c405dd3c21549faa45e78)
2022-10-21stack: Do not add error if pop/shift/value accesses outside of the stackTomas Mraz
This partially reverts commit 30eba7f35983a917f1007bce45040c0af3442e42. This is legitimate use of the stack functions and no error should be reported apart from the NULL return value. Fixes #19389 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19400) (cherry picked from commit a8086e6bfc37355626393751a94bc5c92df7e9d3)
2022-10-19Ensure that the key share group is allowed for our protocol versionMatt Caswell
We should never send or accept a key share group that is not in the supported groups list or a group that isn't suitable for use in TLSv1.3 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19404)
2022-10-11Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes (Merged from https://github.com/openssl/openssl/pull/19382)
2022-09-28Test TLS extension orderingTodd Short
Adding extensions is fragile, with the TLSEXT_TYPE entry needing to be located at TLSEXT_IDX in the array. This adds a test to ensure extensions are in the correct order. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19269) (cherry picked from commit ac44deaf00ad24fd18b9d74de4a23d98a2b75c8d)
2022-09-27If a ticket key callback returns 0 in TLSv1.3 don't send a ticketMatt Caswell
If we can't construct the ticket don't send one. This requires a change to the TLS state machine to be able to a handle a construction function deciding not to send a message after all. Fixes #18977 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19249)
2022-09-22Correctly handle a retransmitted ClientHelloMatt Caswell
If we receive a ClientHello and send back a HelloVerifyRequest, we need to be able to handle the scenario where the HelloVerifyRequest gets lost and we receive another ClientHello with the message sequence number set to 0. Fixes #18635 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18654) (cherry picked from commit 81926c91567cd5d11eec38b9980438f45b276d72)
2022-09-16stack.c: add missing direct error reporting and improve coding styleDr. David von Oheimb
Doing so, had to fix sloppiness in using the stack API in crypto/conf/conf_def.c, ssl/ssl_ciph.c, ssl/statem/statem_srvr.c, and mostly in test/helpers/ssltestlib.c. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/18918) (cherry picked from commit 30eba7f35983a917f1007bce45040c0af3442e42)
2022-08-22Coverity 1508506: misuse of time_tPauli
Fixes a bug in the cookie code which would have caused problems for ten minutes before and after the lower 32 bits of time_t rolled over. Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19023)
2022-08-19Coverity 1508534 & 1508540: misuses of time_tPauli
Avoid problems when the lower 32 bits of time_t roll over by delaying the cast to integer until after the time delta has been computed. Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19004) (cherry picked from commit e8a557dc3c1ed16faff4aeb39268f8f5a3f8b81d)
2022-08-02Check that IV length is not less than zeroDmitry Belyavskiy
As EVP_CIPHER_CTX_get_iv_length indicates failure with -1, this error should be processed. Also the result of this function shouldn't be assigned to an unsigned variable. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Signed-off-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18922)
2022-07-13Check for EVP_MD being NULL inside ssl.slontis
Fix multiple places that could potentially segfault if memory allocations fail. e.g. ssl_load_ciphers() could fail while calling ssl_evp_md_fetch(). Found by #18355 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/18784) (cherry picked from commit b740012f77aed97cb4b3cd8a4f1fb2f668542795)
2022-05-24Use safe pattern for buffer size determining in case of GOST key exchangeDmitry Belyavskiy
Related: CVE-2022-29242 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18381) (cherry picked from commit 2b5e89992e3ada1131beebb2a22722168b9389c2)
2022-05-03Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2022-04-14Fix an assertion in the DTLS server codeBernd Edlinger
This fixes an internal error alert from the server and an unexpected connection failure in the release version, but a failed assertion and a server crash in the debug version. Reproduce this issue with a DTLS server/client like that: ./openssl s_server -dtls -mtu 1500 ./openssl s_client -dtls -maxfraglen 512 In the debug version a crash happens in the Server now: ./openssl s_server -dtls -mtu 1500 Using default temp DH parameters ACCEPT ssl/statem/statem_dtls.c:269: OpenSSL internal error: Assertion failed: len == written Aborted (core dumped) While in the release version the handshake exceeds the negotiated max fragment size, and fails because of this: $ ./openssl s_server -dtls -mtu 1500 Using default temp DH parameters ACCEPT ERROR 4057152ADA7F0000:error:0A0000C2:SSL routines:do_dtls1_write:exceeds max fragment size:ssl/record/rec_layer_d1.c:826: shutting down SSL CONNECTION CLOSED From the client's point of view the connection fails with an Internal Error Alert: $ ./openssl s_client -dtls -maxfraglen 512 Connecting to ::1 CONNECTED(00000003) 40B76343377F0000:error:0A000438:SSL routines:dtls1_read_bytes:tlsv1 alert internal error:ssl/record/rec_layer_d1.c:613:SSL alert number 80 and now the connection attempt fails unexpectedly. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18093) (cherry picked from commit e915c3f5381cd38ebdc1824c3ba9896ea7160103)
2022-03-30tls_process_server_hello: Disallow repeated HRRTomas Mraz
Repeated HRR must be rejected. Fixes #17934 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17936) (cherry picked from commit d204a50b898435fbf937316d5693008cebf62eef)
2022-03-25ticket_lifetime_hint may exceed 1 week in TLSv1.3Todd Short
For TLSv1.3, limit ticket lifetime hint to 1 week per RFC8446 Fixes #17948 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17952) (cherry picked from commit 0089cc7f9d42f6e39872161199fb8b6a99da2492)
2022-03-15Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2022-03-14Replace handling of negative verification result with SSL_set_retry_verify()Tomas Mraz
Provide a different mechanism to indicate that the application wants to retry the verification. The negative result of the callback function now indicates an error again. Instead the SSL_set_retry_verify() can be called from the callback to indicate that the handshake should be suspended. Fixes #17568 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17825) (cherry picked from commit dfb39f73132edf56daaad189e6791d1bdb57c4db)
2022-03-03Add back check for the DH public key sizeTomas Mraz
This is needed for TLS-1.3. Also add check for uncompressed point format for ECDHE as the other formats are not allowed by RFC 8446. Fixes #17667 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17785)
2022-01-19ssl: better support TSAN operationsPauli
For platforms that do not have native TSAN support, locking needs to be used instead. This adds the locking. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17489) (cherry picked from commit acce055778ecbf72e06a254b3a9bf2a2907e5170)
2022-01-11Fix: some patches related to error exitingPeiwei Hu
Signed-off-by: Peiwei Hu <jlu.hpw@foxmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17443)
2022-01-07fix the return check of EVP_PKEY_CTX_ctrl() in 5 spotsxkernel
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17413) (cherry picked from commit 7b1264baab7edd82fea8b27d9ddec048bafc0048)
2022-01-06properly free the resource from CRYPTO_mallocxkernel
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17412) (cherry picked from commit 1b87116a0c43b8b4e1ad88b851d5bcf27c1a5f64)
2021-12-14Fix invalid handling of verify errors in libsslMatt Caswell
In the event that X509_verify() returned an internal error result then libssl would mishandle this and set rwstate to SSL_RETRY_VERIFY. This subsequently causes SSL_get_error() to return SSL_ERROR_WANT_RETRY_VERIFY. That return code is supposed to only ever be returned if an application is using an app verify callback to complete replace the use of X509_verify(). Applications may not be written to expect that return code and could therefore crash (or misbehave in some other way) as a result. CVE-2021-4044 Reviewed-by: Tomas Mraz <tomas@openssl.org>
2021-11-29No EtM for GOST ciphers in TLS 1.2Dmitry Belyavskiy
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17150) (cherry picked from commit d724da69389196cdb9ef8db036656882fbc5a6ab)
2021-11-04Fix a memory leak in tls_parse_stoc_key_shareBernd Edlinger
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16956) (cherry picked from commit b3c34401c088dc247b8b54ea812e7cdde6caf361)
2021-10-27free the Post-Handshake Auth digest when there is an error saving the digestx2018
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16917) (cherry picked from commit 963eb12dbd551df71d7eb054e095c1b85f4aaab9)
2021-10-11New extensions can be sent in a certificate requestMatt Caswell
Normally we expect a client to send new extensions in the ClientHello, which may be echoed back by the server in subsequent messages. However the server can also send a new extension in the certificate request message to be echoed back in a certificate message Fixes #16632 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16634) (cherry picked from commit cbb862fbaaa1ec5a3e33836bc92a6dbea97ceba0)
2021-09-27ssl: Correct filename in READMETianjia Zhang
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16671) (cherry picked from commit 8b6a7da304d4fdd0de38ddd6037d8a02491e3e4e)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-15 15:42:44 +0000