summaryrefslogtreecommitdiffstats
path: root/ssl
AgeCommit message (Collapse)Author
11 daysFix memory leak in quic_trace.cAmir Mohammadi
Fixes #24340 Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24568) (cherry picked from commit 1977c00f00ad0546421a5ec0b40c1326aee4cddb)
2024-06-04Copyright year updatesTomas Mraz
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-05-28Set rl->packet to NULL after we've finished using itMatt Caswell
In order to ensure we do not have a UAF we reset the rl->packet pointer to NULL after we free it. Follow on from CVE-2024-4741 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24395) (cherry picked from commit bfb8128190632092b3a66465838b87b469455cec)
2024-05-28Only free the read buffers if we're not using themMatt Caswell
If we're part way through processing a record, or the application has not released all the records then we should not free our buffer because they are still needed. CVE-2024-4741 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24395) (cherry picked from commit 38690cab18de88198f46478565fab423cf534efa)
2024-05-14Release pkey_ctx on initialization failureirosay
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24366) (cherry picked from commit 3e9d933882407a0792dc3466ba9a0d53d40677a7)
2024-05-14Add reason codes with the correct offset for two alertsJacob Champion
Fixes #24300. The current values of SSL_R_NO_APPLICATION_PROTOCOL and SSL_R_PSK_IDENTITY_NOT_FOUND don't allow for a correct lookup of the corresponding reason strings. CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24351) (cherry picked from commit a401aaf9ed6eb34842cdedfcc35448bdc4174df3)
2024-05-06Fix undefined behaviour in the event of a zero length session idMatt Caswell
Don't attempt to memcpy a NULL pointer if the length is 0. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24309) (cherry picked from commit 97c6489b39c966c6e5169b9b92ec5fa9a35c7ba3)
2024-05-06Set the server sig algs before calling the session_secret_cbMatt Caswell
Setting the server sig algs sets up the certificate "s3->tmp.valid_flags". These are needed when calling ssl3_choose_cipher() which can happen immediately after calling the session_secret_cb Fixes #24213 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24309) (cherry picked from commit 91c7ab27cebe4e6f6a6376e0a691736a2534fdd0)
2024-04-18QUIC TXP: Fix reserve calculations for PING framesHugo Landau
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24122) (cherry picked from commit c3542b22fa3f14d7b6c970d4b2c38a737d6ed8a4)
2024-04-10Change approach to SSL_pending APIHugo Landau
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24039)
2024-04-10QUIC APL: Revise SSL_pending and SSL_has_pending handling for s_client compatHugo Landau
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24039)
2024-04-08Hardening around not_resumable sessionsMatt Caswell
Make sure we can't inadvertently use a not_resumable session Related to CVE-2024-2511 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24043)
2024-04-08Fix unconstrained session cache growth in TLSv1.3Matt Caswell
In TLSv1.3 we create a new session object for each ticket that we send. We do this by duplicating the original session. If SSL_OP_NO_TICKET is in use then the new session will be added to the session cache. However, if early data is not in use (and therefore anti-replay protection is being used), then multiple threads could be resuming from the same session simultaneously. If this happens and a problem occurs on one of the threads, then the original session object could be marked as not_resumable. When we duplicate the session object this not_resumable status gets copied into the new session object. The new session object is then added to the session cache even though it is not_resumable. Subsequently, another bug means that the session_id_length is set to 0 for sessions that are marked as not_resumable - even though that session is still in the cache. Once this happens the session can never be removed from the cache. When that object gets to be the session cache tail object the cache never shrinks again and grows indefinitely. CVE-2024-2511 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24043)
2024-04-03Allow provider sigalgs in SignatureAlgorithms confAlex Bozarth
Though support for provider-based signature algorithms was added in ee58915 this functionality did not work with the SignatureAlgorithms configuration command. If SignatureAlgorithms is set then the provider sigalgs are not used and instead it used the default value. This PR adds a check against the provider-base sigalg list when parsing the SignatureAlgorithms value. Based-on-patch-by: Martin Schmatz <mrt@zurich.ibm.com> Fixes #22761 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/22779) (cherry picked from commit 4169d58c855718d90424fd5da632cf2f2b46e691)
2024-02-22SSL_set1_groups_list(): Fix memory corruption with 40 groups and moreMichael Baentsch
Fixes #23624 The calculation of the size for gid_arr reallocation was wrong. A multiplication by gid_arr array item size was missing. Testcase is added. Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23625) (cherry picked from commit f4ed6eed2c8fcb1852938683669218655fe4f894)
2024-02-16QUIC: Fix SSL_ctrl operation for QSSOsHugo Landau
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23581) (cherry picked from commit 5c16e9d384d1d0f4784352633044610a1f264027)
2024-02-14Fix SSL_export_keying_material for QUICHugo Landau
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23567)
2024-02-09THREADING: Make CRYPTO_MUTEX and CRYPTO_CONDVAR typesafeHugo Landau
There was really no need for this to be void and it made bugs very easy to introduce accidentally, especially given that the free functions needed to be passed a pointer to the pointer. Also fix some bugs in the QUIC code detected immediately by this change. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23519) (cherry picked from commit 62cb7c810e882895a71ba2cc479f482df0aa8e32)
2024-01-31Free the QUIC TLS object before freeing the channelMatt Caswell
Freeing the QUIC TLS object may make calls back into QUIC so we should free it first. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23256) (cherry picked from commit f7f2b665cf91650deb28beb1145ea3eca7df67aa)
2024-01-31Free the tserver TLS object before freeing the channelMatt Caswell
The TLS object may make callbacks into QUIC during cleanup so we must free it first. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23256) (cherry picked from commit fa4b1151c829b8be1d83cb49c9809d3a4f59fb03)
2024-01-31Rationalise RECORD_LAYER_clear() and clear_record_layer()Matt Caswell
We had two functions which were very similarly named, that did almost the same thing, but not quite. We bring the two together. Doing this also fixes a possible bug where some data may not be correctly freed when the RECORD_LAYER_clear() version was used. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23256) (cherry picked from commit 4a0e4849af1588dfe9d7e01738acc96799b83447)
2024-01-31When selecting a method ensure we use the correct client/server versionMatt Caswell
Using the client one when the server once should be used could cause a later call to SSL_set_accept_state() to unexpectedly fail. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23256) (cherry picked from commit a86714041d8a5868c629e9027e28c6d1dacde5f9)
2024-01-31Fix an assertion failure in tls_common.cMatt Caswell
When we clear the record layer, we better make sure we clear all relevant fields, otherwise we can get ourselves into an unexpected state. Fixes #23255 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23256) (cherry picked from commit 5fb065589d3a4dfeeb6d48b0561ab3145ceb2127)
2024-01-30Copyright year updatesMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2024-01-18Don't apply max_frag_len checking if no Max Fragment Length extensionMatt Caswell
Don't check the Max Fragment Length if the it hasn't been negotiated. We were checking it anyway, and using the default value (SSL3_RT_MAX_PLAIN_LENGTH). This works in most cases but KTLS can cause the record length to actually exceed this in some cases. Fixes #23169 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23182) (cherry picked from commit c1decd62460072082833909a962892e5042b16bb)
2024-01-18Document SSL_R_UNEXPECTED_EOF_WHILE_READINGMatt Caswell
Also document that it is ok to use this for control flow decisions. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23304) (cherry picked from commit ead44e19fa3ff7d189876081880f1adb3dfdf30b)
2023-12-20Make SSL_clear_options pass new options to record layerlan1120
Signed-off-by: lan1120 <lanming@huawei.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23045) (cherry picked from commit e8e95f20a9b00ca62d407263110663eba7614683)
2023-12-19Consolidate raising errors in SSL_CONF_cmd()Tomas Mraz
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/23048) (cherry picked from commit 430dcbd0463573fece704263648cc15e891c3d49)
2023-12-19Always apply all configuration settings from the ssl sectionTomas Mraz
Even if some configuration entry is incorrect, do not skip the remaining ones. Fixes #20789 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/23048) (cherry picked from commit 69c067ffbc2c02295e20c90e557b6fcb2f7da69c)
2023-12-19Ensure the default length calculation includes the content type byteMatt Caswell
TLSv1.3 includes an extra byte after the payload for the content type. We should incorporate that in the calculation of the default buffer length. Fixes #23015 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23021) (cherry picked from commit e07b5e1a0a76f25c633a468d4f7945b82ae436bd)
2023-12-12Remove some redundant codeMatt Caswell
We remove a function that was left behind and is no longer called after the record layer refactor Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/22864) (cherry picked from commit e46a6b1a5de0759023c5c9c2143ead4621f20d20)
2023-12-12Don't attempt to set provider params on an ENGINE based cipherMatt Caswell
If an ENGINE has been loaded after the SSL_CTX has been created then the cipher we have cached might be provider based, but the cipher we actually end up using might not be. Don't try to set provider params on a cipher that is actually ENGINE based. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/22864) (cherry picked from commit afcc12c41ad82c5b63194502592de015604dbd47)
2023-11-29Fix freshly introduced double-free.Viktor Dukhovni
We don't need the decoded X.509 Full(0) certificate for the EE usages 1 and 3, because the leaf certificate is always part of the presented chain, so the certificate is only validated as well-formed, and then discarded, but the TLSA record is of course still used after the validation step. Added DANE test cases for: 3 0 0, 3 1 0, 1 0 0, and 1 1 0 Reported by Claus Assmann. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22821) (cherry picked from commit f636e7e6bd8e06c6d84e42729b4131b4f5df488f)
2023-11-28Fix a possible memory leak in ct_move_sctsBernd Edlinger
Instead of trying to move the doomed sct back to the src stack, which may fail as well, simply free the sct object, as the src list will be deleted anyway. Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22762) (cherry picked from commit a435d786046fabc85acdb89cbf47f154a09796e1)
2023-11-22Fix a possible use-after-free in custom_exts_freeBernd Edlinger
This may happen when ssl_cert_dup calls custom_exts_copy, where a possible memory allocation error causes custom_exts_free to be called twice: once in the error handling of custom_exts_copy and a second time in the error handling of ssl_cert_dup. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22772) (cherry picked from commit bc0773bbbd4d3ace6957385f1f22a5cda25dc94f)
2023-11-22Fix a possible memory leak in dane_tlsa_addBernd Edlinger
Several error cases leak either the X509 object or the pkey or the danetls_record object. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22743) (cherry picked from commit e4a94bcc77f3fda0f185e62a73a66d9b9b9388f5)
2023-11-21Move freeing of an old record layer to dtls1_clear_sent_bufferMatt Caswell
When we are clearing the sent messages queue we should ensure we free any old write record layers that are no longer in use. Previously this logic was in dtls1_hm_fragment_free() - but this can end up freeing the current record layer under certain error conditions. Fixes #22664 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22679) (cherry picked from commit a091bc6022b23c0b1caf1c7acbb1f15bdf290816)
2023-11-21zero data in hm_fragment on allocNeil Horman
if we allocate a new hm_frament in dtls1_buffer_message with dtls1_hm_fragment_new, the returned fragment contains uninitalized data in the msg_header field. If an error then occurs, and we free the fragment, dtls_hm_fragment_free interrogates the msg_header field (which is garbage), and potentially references undefined values, or worse, accidentally references available memory that is not owned, leading to various corruptions. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22679) (cherry picked from commit e59ed0bfeece9db433809af2cebbe271a402d59b)
2023-11-15Correct tag len check when determining how much space we have in the pktMatt Caswell
If the available space is equal to the tag length then we have no available space for plaintext data. Fixes #22699 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22715) (cherry picked from commit 46376fcf4b6d11ec417c2a530475037d4d09fcbf)
2023-11-15Keep track of connection credit as we add stream dataMatt Caswell
If a single packet contains data from multiple streams we need to keep track of the cummulative connection level credit consumed across all of the streams. Once the connection level credit has been consumed we must stop adding stream data. Fixes #22706 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22718) (cherry picked from commit e57bf6b3bfa2f0b18e5cad7fd3c5fdd7c51516b9)
2023-11-09Fix a possible memory leak of ssl->s3.tmp.pskBernd Edlinger
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22637) (cherry picked from commit a2b1ab6100d5f0fb50b61d241471eea087415632)
2023-11-09After a stream has implicit length don't add more stream related framesMatt Caswell
Once we have decided that a stream has an implicit length then we should treat the packet as full and not try to add any more stream related frames to the packet. Fixes #22658 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22662) (cherry picked from commit 7fe3010471a3263b2469ae35589357089050ce62)
2023-11-08QUIC TXP: Handle padding correctly for ACK_ONLY archetypeHugo Landau
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22615) (cherry picked from commit e1c15a8abeb87a387cc7c64a424ca5f282b00632)
2023-11-08QUIC TXP: Fix use of implicit-length STREAM frames in presence of ↵Hugo Landau
PATH_REPSONSE frames Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22615) (cherry picked from commit 3bef14c5367b4e2d7aded4f80e78e8f19b74f710)
2023-11-08Fix bug in priority queue remove functionPauli
The short circuit in the remove function when the element is the last in the heap, failed to add the removed slot back to the freelist. Fixes #22644 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22646) (cherry picked from commit a03108778044cc0d428ce38084ef6f318446fbe3)
2023-11-08Fix a possible memory leak in custom_ext_addBernd Edlinger
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22638) (cherry picked from commit 668a144f0a6dcfb9f904043c29372cbf19856c39)
2023-11-06Correctly track the original length when generating a stream frameMatt Caswell
txp_generate_stream_frames() plans chunks of data to send via the function txp_plan_stream_chunk(). That function may clamp the amount in the chunk due to flow control, even though there is more available to send. We should take this into account when deciding whether or not to try serializing the next chunk. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22601) (cherry picked from commit e718b248f94fa41562b740482813716a2ff13db5)
2023-11-06ossl_quic_new(): Avoid dereferencing NULL qc during cleanupTomas Mraz
Fixes Coverity 1548383 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22606) (cherry picked from commit 0e2e4b3e69d4012f47b6908c2d8a13ec4e2d40e0)
2023-11-06ossl_qrl_enc_level_set_provide_secret(): Avoid leaking keyslot in error ↵Tomas Mraz
condition Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22600) (cherry picked from commit 0c2aabbaeacf1cc9864daaed11fae755fe7bc025)
2023-11-02TLS: Fix use of an uninitialized valueHugo Landau
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22523) (cherry picked from commit f62fec64049959cee6b80043cd697d0e7357a24a)
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-21 07:22:24 +0000