- 19 Aug, 2016 9 commits
-
-
Matt Caswell authored
The DTLS implementation provides some protection against replay attacks in accordance with RFC6347 section 4.1.2.6. A sliding "window" of valid record sequence numbers is maintained with the "right" hand edge of the window set to the highest sequence number we have received so far. Records that arrive that are off the "left" hand edge of the window are rejected. Records within the window are checked against a list of records received so far. If we already received it then we also reject the new record. If we have not already received the record, or the sequence number is off the right hand edge of the window then we verify the MAC of the record. If MAC verification fails then we discard the record. Otherwise we mark the record as received. If the sequence number was off the right hand edge of the window, then we slide the window along so that the right hand edge is in line with the newly received sequence number. Records may arrive for future epochs, i.e. a record from after a CCS being sent, can arrive before the CCS does if the packets get re-ordered. As we have not yet received the CCS we are not yet in a position to decrypt or validate the MAC of those records. OpenSSL places those records on an unprocessed records queue. It additionally updates the window immediately, even though we have not yet verified the MAC. This will only occur if currently in a handshake/renegotiation. This could be exploited by an attacker by sending a record for the next epoch (which does not have to decrypt or have a valid MAC), with a very large sequence number. This means the right hand edge of the window is moved very far to the right, and all subsequent legitimate packets are dropped causing a denial of service. A similar effect can be achieved during the initial handshake. In this case there is no MAC key negotiated yet. Therefore an attacker can send a message for the current epoch with a very large sequence number. The code will process the record as normal. If the hanshake message sequence number (as opposed to the record sequence number that we have been talking about so far) is in the future then the injected message is bufferred to be handled later, but the window is still updated. Therefore all subsequent legitimate handshake records are dropped. This aspect is not considered a security issue because there are many ways for an attacker to disrupt the initial handshake and prevent it from completing successfully (e.g. injection of a handshake message will cause the Finished MAC to fail and the handshake to be aborted). This issue comes about as a result of trying to do replay protection, but having no integrity mechanism in place yet. Does it even make sense to have replay protection in epoch 0? That issue isn't addressed here though. This addressed an OCAP Audit issue. CVE-2016-2181 Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Injects a record from epoch 1 during epoch 0 handshake, with a record sequence number in the future, to test that the record replay protection feature works as expected. This is described more fully in the next commit. Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
During a DTLS handshake we may get records destined for the next epoch arrive before we have processed the CCS. In that case we can't decrypt or verify the record yet, so we buffer it for later use. When we do receive the CCS we work through the queue of unprocessed records and process them. Unfortunately the act of processing wipes out any existing packet data that we were still working through. This includes any records from the new epoch that were in the same packet as the CCS. We should only process the buffered records if we've not got any data left. Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Add a test to inject a record from the next epoch during the handshake and make sure it doesn't get processed immediately. Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Enables the testing of DTLS code in 1.0.2 Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Richard Levitte authored
- make the VMS version of RAND_poll() faster and more secure - avoid pointer size warnings with setvbuf() Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Richard Levitte authored
Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Richard Levitte authored
Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Richard Levitte authored
Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 18 Aug, 2016 1 commit
-
-
Richard Levitte authored
Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 16 Aug, 2016 1 commit
-
-
Richard Levitte authored
Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 15 Aug, 2016 3 commits
-
-
Dr. Stephen Henson authored
Apply a limit to the maximum blob length which can be read in do_d2i_bio() to avoid excessive allocation. Thanks to Shi Lei for reporting this. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 66bcba14)
-
Dr. Stephen Henson authored
If an oversize BIGNUM is presented to BN_bn2dec() it can cause BN_div_word() to fail and not reduce the value of 't' resulting in OOB writes to the bn_data buffer and eventually crashing. Fix by checking return value of BN_div_word() and checking writes don't overflow buffer. Thanks to Shi Lei for reporting this bug. CVE-2016-2182 Reviewed-by:
Tim Hudson <tjh@openssl.org> (cherry picked from commit 07bed46f) Conflicts: crypto/bn/bn_print.c
-
Dr. Stephen Henson authored
Check for error return in BN_div_word(). Reviewed-by:
Tim Hudson <tjh@openssl.org> (cherry picked from commit 8b9afbc0)
-
- 11 Aug, 2016 1 commit
-
-
Andy Polyakov authored
RT#4530 Reviewed-by:
Tim Hudson <tjh@openssl.org> (cherry picked from commit 7123aa81)
-
- 05 Aug, 2016 2 commits
-
-
Dr. Stephen Henson authored
Thanks to Hanno Böck for reporting this bug. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 39a43280) Conflicts: crypto/pkcs12/p12_utl.c
-
Dr. Stephen Henson authored
Fix error path leaks in a2i_ASN1_STRING(), a2i_ASN1_INTEGER() and a2i_ASN1_ENUMERATED(). Thanks to Shi Lei for reporting these issues. Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 04 Aug, 2016 4 commits
-
-
Kurt Roeckx authored
GH: #1322 (cherry picked from commit 5e3553c2 ) Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Stephen Henson <steve@openssl.org>
-
Dr. Stephen Henson authored
Thanks to Shi Lei for reporting this bug. Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
Thanks to Shi Lei for reporting this issue. Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
Thanks to Shi Lei for reporting this issue. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 20fc103f) Conflicts: include/openssl/ts.h
-
- 03 Aug, 2016 1 commit
-
-
Richard Levitte authored
Because proxy certificates typically come without any CRL information, trying to check revocation on them will fail. Better not to try checking such information for them at all. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 790555d6)
-
- 02 Aug, 2016 4 commits
-
-
Dr. Stephen Henson authored
Use correct length in old ASN.1 indefinite length sequence decoder (only used by SSL_SESSION). This bug was discovered by Hanno Böck using libfuzzer. Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> (cherry picked from commit e9f17097)
-
Dr. Stephen Henson authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> (cherry picked from commit 56f9953c)
-
- 29 Jul, 2016 1 commit
-
-
Dr. Stephen Henson authored
Thanks to David Benjamin <davidben@google.com> for reporting this bug. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit e032117d)
-
- 28 Jul, 2016 1 commit
-
-
Rich Salz authored
Reviewed-by:
Dr. Stephen Henson <steve@openssl.org>
-
- 26 Jul, 2016 2 commits
-
-
Dr. Stephen Henson authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 976ef6ad) Conflicts: crypto/evp/bio_enc.c
-
Dr. Stephen Henson authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit ee6ce5cc) Conflicts: crypto/evp/bio_enc.c
-
- 22 Jul, 2016 4 commits
-
-
Dr. Stephen Henson authored
If two CRLs are equivalent then use the one with a later lastUpdate field: this will result in the newest CRL available being used. RT#4615 Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 626aa248)
-
Dr. Stephen Henson authored
RT#4511 Reviewed-by:
Matt Caswell <matt@openssl.org>
-
Dr. Stephen Henson authored
TS_OBJ_print_bio() misuses OBJ_txt2obj: it should print the result as a null terminated buffer. The length value returned is the total length the complete text reprsentation would need not the amount of data written. CVE-2016-2180 Thanks to Shi Lei for reporting this bug. Reviewed-by:
Matt Caswell <matt@openssl.org> (cherry picked from commit 0ed26acc)
-
Dr. Stephen Henson authored
RT#4603 Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 20 Jul, 2016 1 commit
-
-
Todd Short authored
There are two failure cases for OCSP_request_add_id(): 1. OCSP_ONEREQ_new() failure, where |cid| is not freed 2. sk_OCSP_ONEREQ_push() failure, where |cid| is freed This changes makes the error behavior consistent, such that |cid| is not freed when sk_OCSP_ONEREQ_push() fails. OpenSSL only takes ownership of |cid| when the function succeeds. Reviewed-by:
Matt Caswell <matt@openssl.org> Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1289) (cherry picked from commit 415e7c48)
-
- 19 Jul, 2016 4 commits
-
-
Dr. Stephen Henson authored
RT#4600 Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 52eede5a) Conflicts: ssl/s3_lib.c
-
Dr. Stephen Henson authored
RT#4610 Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
Extended alg_print() in pkcs12 utility to support PBES2 algorithms. RT#4588 Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Dr. Stephen Henson authored
If underlying type is boolean don't check field is NULL. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit ad72d9fd)
-
- 18 Jul, 2016 1 commit
-
-
Dr. Stephen Henson authored
The ASN.1 BIGNUM type needs to be handled in a custom way as it is not a generic ASN1_STRING type. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 3cea73a7) Conflicts: crypto/asn1/x_bignum.c
-