- 22 Aug, 2016 1 commit
-
-
Matt Caswell authored
DTLS can handle out of order record delivery. Additionally since handshake messages can be bigger than will fit into a single packet, the messages can be fragmented across multiple records (as with normal TLS). That means that the messages can arrive mixed up, and we have to reassemble them. We keep a queue of buffered messages that are "from the future", i.e. messages we're not ready to deal with yet but have arrived early. The messages held there may not be full yet - they could be one or more fragments that are still in the process of being reassembled. The code assumes that we will eventually complete the reassembly and when that occurs the complete message is removed from the queue at the point that we need to use it. However, DTLS is also tolerant of packet loss. To get around that DTLS messages can be retransmitted. If we receive a full (non-fragmented) message from the peer after previously having received a fragment of that message, then we ignore the message in the queue and just use the non-fragmented version. At that point the queued message will never get removed. Additionally the peer could send "future" messages that we never get to in order to complete the handshake. Each message has a sequence number (starting from 0). We will accept a message fragment for the current message sequence number, or for any sequence up to 10 into the future. However if the Finished message has a sequence number of 2, anything greater than that in the queue is just left there. So, in those two ways we can end up with "orphaned" data in the queue that will never get removed - except when the connection is closed. At that point all the queues are flushed. An attacker could seek to exploit this by filling up the queues with lots of large messages that are never going to be used in order to attempt a DoS by memory exhaustion. I will assume that we are only concerned with servers here. It does not seem reasonable to be concerned about a memory exhaustion attack on a client. They are unlikely to process enough connections for this to be an issue. A "long" handshake with many messages might be 5 messages long (in the incoming direction), e.g. ClientHello, Certificate, ClientKeyExchange, CertificateVerify, Finished. So this would be message sequence numbers 0 to 4. Additionally we can buffer up to 10 messages in the future. Therefore the maximum number of messages that an attacker could send that could get orphaned would typically be 15. The maximum size that a DTLS message is allowed to be is defined by max_cert_list, which by default is 100k. Therefore the maximum amount of "orphaned" memory per connection is 1500k. Message sequence numbers get reset after the Finished message, so renegotiation will not extend the maximum number of messages that can be orphaned per connection. As noted above, the queues do get cleared when the connection is closed. Therefore in order to mount an effective attack, an attacker would have to open many simultaneous connections. Issue reported by Quan Luo. CVE-2016-2179 Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
- 20 Aug, 2016 1 commit
-
-
Kurt Roeckx authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> MR: #3176 (cherry picked from commit a73be798)
-
- 19 Aug, 2016 4 commits
-
-
Rich Salz authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> (cherry picked from commit 2a9afa40)
-
Matt Caswell authored
A function error code needed updating due to merge issues. Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
The DTLS implementation provides some protection against replay attacks in accordance with RFC6347 section 4.1.2.6. A sliding "window" of valid record sequence numbers is maintained with the "right" hand edge of the window set to the highest sequence number we have received so far. Records that arrive that are off the "left" hand edge of the window are rejected. Records within the window are checked against a list of records received so far. If we already received it then we also reject the new record. If we have not already received the record, or the sequence number is off the right hand edge of the window then we verify the MAC of the record. If MAC verification fails then we discard the record. Otherwise we mark the record as received. If the sequence number was off the right hand edge of the window, then we slide the window along so that the right hand edge is in line with the newly received sequence number. Records may arrive for future epochs, i.e. a record from after a CCS being sent, can arrive before the CCS does if the packets get re-ordered. As we have not yet received the CCS we are not yet in a position to decrypt or validate the MAC of those records. OpenSSL places those records on an unprocessed records queue. It additionally updates the window immediately, even though we have not yet verified the MAC. This will only occur if currently in a handshake/renegotiation. This could be exploited by an attacker by sending a record for the next epoch (which does not have to decrypt or have a valid MAC), with a very large sequence number. This means the right hand edge of the window is moved very far to the right, and all subsequent legitimate packets are dropped causing a denial of service. A similar effect can be achieved during the initial handshake. In this case there is no MAC key negotiated yet. Therefore an attacker can send a message for the current epoch with a very large sequence number. The code will process the record as normal. If the hanshake message sequence number (as opposed to the record sequence number that we have been talking about so far) is in the future then the injected message is bufferred to be handled later, but the window is still updated. Therefore all subsequent legitimate handshake records are dropped. This aspect is not considered a security issue because there are many ways for an attacker to disrupt the initial handshake and prevent it from completing successfully (e.g. injection of a handshake message will cause the Finished MAC to fail and the handshake to be aborted). This issue comes about as a result of trying to do replay protection, but having no integrity mechanism in place yet. Does it even make sense to have replay protection in epoch 0? That issue isn't addressed here though. This addressed an OCAP Audit issue. CVE-2016-2181 Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
During a DTLS handshake we may get records destined for the next epoch arrive before we have processed the CCS. In that case we can't decrypt or verify the record yet, so we buffer it for later use. When we do receive the CCS we work through the queue of unprocessed records and process them. Unfortunately the act of processing wipes out any existing packet data that we were still working through. This includes any records from the new epoch that were in the same packet as the CCS. We should only process the buffered records if we've not got any data left. Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
- 16 Aug, 2016 1 commit
-
-
Richard Levitte authored
(cherry picked from commit a1be17a7 ) Conflicts: crypto/pem/pem_err.c Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Stephen Henson <steve@openssl.org>
-
- 15 Aug, 2016 3 commits
-
-
Dr. Stephen Henson authored
Apply a limit to the maximum blob length which can be read in do_d2i_bio() to avoid excessive allocation. Thanks to Shi Lei for reporting this. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 66bcba14)
-
Dr. Stephen Henson authored
If an oversize BIGNUM is presented to BN_bn2dec() it can cause BN_div_word() to fail and not reduce the value of 't' resulting in OOB writes to the bn_data buffer and eventually crashing. Fix by checking return value of BN_div_word() and checking writes don't overflow buffer. Thanks to Shi Lei for reporting this bug. CVE-2016-2182 Reviewed-by:
Tim Hudson <tjh@openssl.org> (cherry picked from commit 07bed46f) Conflicts: crypto/bn/bn_print.c
-
Dr. Stephen Henson authored
Check for error return in BN_div_word(). Reviewed-by:
Tim Hudson <tjh@openssl.org> (cherry picked from commit 8b9afbc0)
-
- 05 Aug, 2016 2 commits
-
-
Dr. Stephen Henson authored
Thanks to Hanno Böck for reporting this bug. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 39a43280) Conflicts: crypto/pkcs12/p12_utl.c
-
Dr. Stephen Henson authored
Fix error path leaks in a2i_ASN1_STRING(), a2i_ASN1_INTEGER() and a2i_ASN1_ENUMERATED(). Thanks to Shi Lei for reporting these issues. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit e1be1dce)
-
- 04 Aug, 2016 3 commits
-
-
Kurt Roeckx authored
GH: #1322 Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Stephen Henson <steve@openssl.org> (cherry picked from commit 32baafb2)
-
Dr. Stephen Henson authored
Thanks to Shi Lei for reporting this bug. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 81f69e5b)
-
Dr. Stephen Henson authored
Thanks to Shi Lei for reporting this issue. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit af601b83)
-
- 03 Aug, 2016 1 commit
-
-
Dr. Stephen Henson authored
Use correct length in old ASN.1 indefinite length sequence decoder (only used by SSL_SESSION). This bug was discovered by Hanno Böck using libfuzzer. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 436dead2)
-
- 02 Aug, 2016 3 commits
-
-
Dr. Stephen Henson authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 134ab513)
-
Dr. Stephen Henson authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> (cherry picked from commit e9f17097)
-
Dr. Stephen Henson authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> (cherry picked from commit 56f9953c)
-
- 22 Jul, 2016 1 commit
-
-
Dr. Stephen Henson authored
TS_OBJ_print_bio() misuses OBJ_txt2obj: it should print the result as a null terminated buffer. The length value returned is the total length the complete text reprsentation would need not the amount of data written. CVE-2016-2180 Thanks to Shi Lei for reporting this bug. Reviewed-by:
Matt Caswell <matt@openssl.org> (cherry picked from commit 0ed26acc)
-
- 30 Jun, 2016 1 commit
-
-
Matt Caswell authored
Ensure things really do get cleared when we intend them to. Addresses an OCAP Audit issue. Reviewed-by:
Andy Polyakov <appro@openssl.org> (cherry picked from commit cb5ebf96)
-
- 29 Jun, 2016 3 commits
-
-
Richard Levitte authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 6ad8c482)
-
Richard Levitte authored
While travelling up the certificate chain, the internal proxy_path_length must be updated with the pCPathLengthConstraint value, or verification will not work properly. This corresponds to RFC 3820, 4.1.4 (a). Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 30aeb312)
-
Richard Levitte authored
The subject name MUST be the same as the issuer name, with a single CN entry added. RT#1852 Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 338fb168)
-
- 27 Jun, 2016 1 commit
-
-
Matt Caswell authored
RAND_pseudo_bytes() allows random data to be returned even in low entropy conditions. Sometimes this is ok. Many times it is not. For the avoidance of any doubt, replace existing usage of RAND_pseudo_bytes() with RAND_bytes(). Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 07 Jun, 2016 1 commit
-
-
Matt Caswell authored
The previous "fix" still left "k" exposed to constant time problems in the later BN_mod_inverse() call. Ensure both k and kq have the BN_FLG_CONSTTIME flag set at the earliest opportunity after creation. CVE-2016-2178 Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit b7d0f283)
-
- 06 Jun, 2016 1 commit
-
-
Cesar Pereida authored
Operations in the DSA signing algorithm should run in constant time in order to avoid side channel attacks. A flaw in the OpenSSL DSA implementation means that a non-constant time codepath is followed for certain operations. This has been demonstrated through a cache-timing attack to be sufficient for an attacker to recover the private DSA key. CVE-2016-2178 Reviewed-by:
Richard Levitte <levitte@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org> (cherry picked from commit 621eaf49)
-
- 03 Jun, 2016 1 commit
-
-
Matt Caswell authored
Fix typos and clarify a few things in the CONTRIBUTING file. Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 01 Jun, 2016 1 commit
-
-
Matt Caswell authored
A common idiom in the codebase is: if (p + len > limit) { return; /* Too long */ } Where "p" points to some malloc'd data of SIZE bytes and limit == p + SIZE "len" here could be from some externally supplied data (e.g. from a TLS message). The rules of C pointer arithmetic are such that "p + len" is only well defined where len <= SIZE. Therefore the above idiom is actually undefined behaviour. For example this could cause problems if some malloc implementation provides an address for "p" such that "p + len" actually overflows for values of len that are too big and therefore p + len < limit! Issue reported by Guido Vranken. CVE-2016-2177 Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 26 May, 2016 2 commits
-
-
Viktor Dukhovni authored
Set ctx->error = X509_V_ERR_OUT_OF_MEM when verificaiton cannot continue due to malloc failure. Similarly for issuer lookup failures and caller errors (bad parameters or invalid state). Also, when X509_verify_cert() returns <= 0 make sure that the verification status does not remain X509_V_OK, as a last resort set it it to X509_V_ERR_UNSPECIFIED, just in case some code path returns an error without setting an appropriate value of ctx->error. Add new and some missing error codes to X509 error -> SSL alert switch. Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Viktor Dukhovni authored
Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 23 May, 2016 1 commit
-
-
Matt Caswell authored
The functions SRP_Calc_client_key() and SRP_Calc_server_key() were incorrectly returning a valid pointer in the event of error. Issue reported by Yuan Jochen Kang Reviewed-by:
Richard Levitte <levitte@openssl.org> (cherry picked from commit 308ff286)
-
- 19 May, 2016 1 commit
-
-
Matt Caswell authored
In the X509 app check that the obtained public key is valid before we attempt to use it. Issue reported by Yuan Jochen Kang. Reviewed-by:
Viktor Dukhovni <viktor@openssl.org>
-
- 11 May, 2016 2 commits
-
-
Rich Salz authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> (cherry picked from commit c393a5de)
-
Dr. Stephen Henson authored
Reviewed-by:
Viktor Dukhovni <viktor@openssl.org>
-
- 09 May, 2016 1 commit
-
-
Dr. Stephen Henson authored
RT#3826 Reviewed-by:
Tim Hudson <tjh@openssl.org> (cherry picked from commit 2b4825d0)
-
- 06 May, 2016 3 commits
-
-
Dr. Stephen Henson authored
PR#4449 Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit b1f8ba4d)
-
Dr. Stephen Henson authored
PR#4466 Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 06227924)
-
Dr. Stephen Henson authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 708cf5de)
-
- 05 May, 2016 1 commit
-
-
Dr. Stephen Henson authored
The default ASN.1 handling can be used for SEED. This also makes CMS work with SEED. PR#4504 Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit c0aa8c27)
-