Add SA-14:14.openssl.
This commit is contained in:
Xin LI
parent
7832d2830b
commit
05be27dd8f
Notes:
svn2git
2020-12-08 03:00:23 +00:00
svn path=/head/; revision=45011
6 changed files with 493 additions and 0 deletions
146
share/security/patches/SA-14:14/openssl-10.patch
Normal file
146
share/security/patches/SA-14:14/openssl-10.patch
Normal file
|
|
@ -0,0 +1,146 @@
|
|||
Index: crypto/openssl/ssl/d1_both.c
|
||||
===================================================================
|
||||
--- crypto/openssl/ssl/d1_both.c (revision 267031)
|
||||
+++ crypto/openssl/ssl/d1_both.c (working copy)
|
||||
@@ -627,8 +627,17 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header
|
||||
frag->msg_header.frag_off = 0;
|
||||
}
|
||||
else
|
||||
+ {
|
||||
frag = (hm_fragment*) item->data;
|
||||
+ if (frag->msg_header.msg_len != msg_hdr->msg_len)
|
||||
+ {
|
||||
+ item = NULL;
|
||||
+ frag = NULL;
|
||||
+ goto err;
|
||||
+ }
|
||||
+ }
|
||||
|
||||
+
|
||||
/* If message is already reassembled, this must be a
|
||||
* retransmit and can be dropped.
|
||||
*/
|
||||
@@ -784,6 +793,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int st
|
||||
int i,al;
|
||||
struct hm_header_st msg_hdr;
|
||||
|
||||
+ redo:
|
||||
/* see if we have the required fragment already */
|
||||
if ((frag_len = dtls1_retrieve_buffered_fragment(s,max,ok)) || *ok)
|
||||
{
|
||||
@@ -842,8 +852,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int st
|
||||
s->msg_callback_arg);
|
||||
|
||||
s->init_num = 0;
|
||||
- return dtls1_get_message_fragment(s, st1, stn,
|
||||
- max, ok);
|
||||
+ goto redo;
|
||||
}
|
||||
else /* Incorrectly formated Hello request */
|
||||
{
|
||||
Index: crypto/openssl/ssl/s3_clnt.c
|
||||
===================================================================
|
||||
--- crypto/openssl/ssl/s3_clnt.c (revision 267031)
|
||||
+++ crypto/openssl/ssl/s3_clnt.c (working copy)
|
||||
@@ -559,6 +559,7 @@ int ssl3_connect(SSL *s)
|
||||
case SSL3_ST_CR_FINISHED_A:
|
||||
case SSL3_ST_CR_FINISHED_B:
|
||||
|
||||
+ s->s3->flags |= SSL3_FLAGS_CCS_OK;
|
||||
ret=ssl3_get_finished(s,SSL3_ST_CR_FINISHED_A,
|
||||
SSL3_ST_CR_FINISHED_B);
|
||||
if (ret <= 0) goto end;
|
||||
@@ -915,6 +916,7 @@ int ssl3_get_server_hello(SSL *s)
|
||||
SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
|
||||
goto f_err;
|
||||
}
|
||||
+ s->s3->flags |= SSL3_FLAGS_CCS_OK;
|
||||
s->hit=1;
|
||||
}
|
||||
else /* a miss or crap from the other end */
|
||||
@@ -2510,6 +2512,13 @@ int ssl3_send_client_key_exchange(SSL *s)
|
||||
int ecdh_clnt_cert = 0;
|
||||
int field_size = 0;
|
||||
|
||||
+ if (s->session->sess_cert == NULL)
|
||||
+ {
|
||||
+ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
|
||||
+ SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
|
||||
+ goto err;
|
||||
+ }
|
||||
+
|
||||
/* Did we send out the client's
|
||||
* ECDH share for use in premaster
|
||||
* computation as part of client certificate?
|
||||
Index: crypto/openssl/ssl/s3_pkt.c
|
||||
===================================================================
|
||||
--- crypto/openssl/ssl/s3_pkt.c (revision 267031)
|
||||
+++ crypto/openssl/ssl/s3_pkt.c (working copy)
|
||||
@@ -1301,6 +1301,15 @@ start:
|
||||
goto f_err;
|
||||
}
|
||||
|
||||
+ if (!(s->s3->flags & SSL3_FLAGS_CCS_OK))
|
||||
+ {
|
||||
+ al=SSL_AD_UNEXPECTED_MESSAGE;
|
||||
+ SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_CCS_RECEIVED_EARLY);
|
||||
+ goto f_err;
|
||||
+ }
|
||||
+
|
||||
+ s->s3->flags &= ~SSL3_FLAGS_CCS_OK;
|
||||
+
|
||||
rr->length=0;
|
||||
|
||||
if (s->msg_callback)
|
||||
@@ -1435,7 +1444,7 @@ int ssl3_do_change_cipher_spec(SSL *s)
|
||||
|
||||
if (s->s3->tmp.key_block == NULL)
|
||||
{
|
||||
- if (s->session == NULL)
|
||||
+ if (s->session == NULL || s->session->master_key_length == 0)
|
||||
{
|
||||
/* might happen if dtls1_read_bytes() calls this */
|
||||
SSLerr(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC,SSL_R_CCS_RECEIVED_EARLY);
|
||||
Index: crypto/openssl/ssl/s3_srvr.c
|
||||
===================================================================
|
||||
--- crypto/openssl/ssl/s3_srvr.c (revision 267031)
|
||||
+++ crypto/openssl/ssl/s3_srvr.c (working copy)
|
||||
@@ -673,6 +673,7 @@ int ssl3_accept(SSL *s)
|
||||
case SSL3_ST_SR_CERT_VRFY_A:
|
||||
case SSL3_ST_SR_CERT_VRFY_B:
|
||||
|
||||
+ s->s3->flags |= SSL3_FLAGS_CCS_OK;
|
||||
/* we should decide if we expected this one */
|
||||
ret=ssl3_get_cert_verify(s);
|
||||
if (ret <= 0) goto end;
|
||||
@@ -700,6 +701,7 @@ int ssl3_accept(SSL *s)
|
||||
|
||||
case SSL3_ST_SR_FINISHED_A:
|
||||
case SSL3_ST_SR_FINISHED_B:
|
||||
+ s->s3->flags |= SSL3_FLAGS_CCS_OK;
|
||||
ret=ssl3_get_finished(s,SSL3_ST_SR_FINISHED_A,
|
||||
SSL3_ST_SR_FINISHED_B);
|
||||
if (ret <= 0) goto end;
|
||||
@@ -770,7 +772,10 @@ int ssl3_accept(SSL *s)
|
||||
s->s3->tmp.next_state=SSL3_ST_SR_FINISHED_A;
|
||||
#else
|
||||
if (s->s3->next_proto_neg_seen)
|
||||
+ {
|
||||
+ s->s3->flags |= SSL3_FLAGS_CCS_OK;
|
||||
s->s3->tmp.next_state=SSL3_ST_SR_NEXT_PROTO_A;
|
||||
+ }
|
||||
else
|
||||
s->s3->tmp.next_state=SSL3_ST_SR_FINISHED_A;
|
||||
#endif
|
||||
Index: crypto/openssl/ssl/ssl3.h
|
||||
===================================================================
|
||||
--- crypto/openssl/ssl/ssl3.h (revision 267031)
|
||||
+++ crypto/openssl/ssl/ssl3.h (working copy)
|
||||
@@ -399,6 +399,7 @@ typedef struct ssl3_buffer_st
|
||||
* effected, but we can't prevent that.
|
||||
*/
|
||||
#define SSL3_FLAGS_SGC_RESTART_DONE 0x0040
|
||||
+#define SSL3_FLAGS_CCS_OK 0x0080
|
||||
|
||||
#ifndef OPENSSL_NO_SSL_INTERN
|
||||
|
||||
17
share/security/patches/SA-14:14/openssl-10.patch.asc
Normal file
17
share/security/patches/SA-14:14/openssl-10.patch.asc
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
-----BEGIN PGP SIGNATURE-----
|
||||
Version: GnuPG v2.0.22 (FreeBSD)
|
||||
|
||||
iQIcBAABCgAGBQJTkGnSAAoJEO1n7NZdz2rnnkEQAOu1iaWZHInskbHmwN5bEpSA
|
||||
66PfKJRO+dT0lfAPzX8NOlgCo/Vy8NR7OMSf5KHhAMz8qBV67FAbj9V8FNra3jp/
|
||||
u6S9q7ln5HnUhBvia4aLI31vKTINRooPg7fgMXxTG7dWHMa2E9j56q5PXZ5wkTCA
|
||||
+BsAFKPKpL4ceZ1MXNwm/YQS3HxnEfVWBsPjues9mnNShgZIjz11PlH05zMrJOUB
|
||||
gi4bru1v7a66ssejz3RQ/zJ0u1IYnVPzVLbAsAyyr8vd71vvzXOLmfgcdvWCcotZ
|
||||
kPQbIKacAnbtRULyIEFDXHVLGays3u+c33QzQX1M7Pu5QGXymLrpOzpna4aR99Ax
|
||||
jxB50tT6d0KchOyn3M10bd9MMSyiEv2bCvp3GPdrTM5ouKjYFgsQDoazZubV+Rai
|
||||
vto2glhQi29oGkj0NuXf13Ijgn0Yu3qJIkJNsTXGzMaEvcIKyHNaGDdDqHOgOiUQ
|
||||
2EtEmmE79zbnf+3jkT3jjMcU3bxmj1aG+kX/ErK2yWAGVjYsetimCUSu4yT6Pv/+
|
||||
MKONbGDswMqWAIMWwLUp4kkbDDyQC7eTGB4OFLn1BVg5ol+FRD8VcAHfWasSE1WW
|
||||
BiAk1TvN9Sp+ZLXZBphNwp8lbm3gwUwTpvs7X81B0RByN7rx7hLBaJ1viW7mMx0K
|
||||
JV+/Ei2voErvo1J0xd9W
|
||||
=QTlX
|
||||
-----END PGP SIGNATURE-----
|
||||
135
share/security/patches/SA-14:14/openssl-9.patch
Normal file
135
share/security/patches/SA-14:14/openssl-9.patch
Normal file
|
|
@ -0,0 +1,135 @@
|
|||
Index: crypto/openssl/ssl/d1_both.c
|
||||
===================================================================
|
||||
--- crypto/openssl/ssl/d1_both.c (revision 267031)
|
||||
+++ crypto/openssl/ssl/d1_both.c (working copy)
|
||||
@@ -620,8 +620,17 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header
|
||||
frag->msg_header.frag_off = 0;
|
||||
}
|
||||
else
|
||||
+ {
|
||||
frag = (hm_fragment*) item->data;
|
||||
+ if (frag->msg_header.msg_len != msg_hdr->msg_len)
|
||||
+ {
|
||||
+ item = NULL;
|
||||
+ frag = NULL;
|
||||
+ goto err;
|
||||
+ }
|
||||
+ }
|
||||
|
||||
+
|
||||
/* If message is already reassembled, this must be a
|
||||
* retransmit and can be dropped.
|
||||
*/
|
||||
@@ -777,6 +786,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int st
|
||||
int i,al;
|
||||
struct hm_header_st msg_hdr;
|
||||
|
||||
+ redo:
|
||||
/* see if we have the required fragment already */
|
||||
if ((frag_len = dtls1_retrieve_buffered_fragment(s,max,ok)) || *ok)
|
||||
{
|
||||
@@ -835,8 +845,7 @@ dtls1_get_message_fragment(SSL *s, int st1, int st
|
||||
s->msg_callback_arg);
|
||||
|
||||
s->init_num = 0;
|
||||
- return dtls1_get_message_fragment(s, st1, stn,
|
||||
- max, ok);
|
||||
+ goto redo;
|
||||
}
|
||||
else /* Incorrectly formated Hello request */
|
||||
{
|
||||
Index: crypto/openssl/ssl/s3_clnt.c
|
||||
===================================================================
|
||||
--- crypto/openssl/ssl/s3_clnt.c (revision 267031)
|
||||
+++ crypto/openssl/ssl/s3_clnt.c (working copy)
|
||||
@@ -491,6 +491,7 @@ int ssl3_connect(SSL *s)
|
||||
case SSL3_ST_CR_FINISHED_A:
|
||||
case SSL3_ST_CR_FINISHED_B:
|
||||
|
||||
+ s->s3->flags |= SSL3_FLAGS_CCS_OK;
|
||||
ret=ssl3_get_finished(s,SSL3_ST_CR_FINISHED_A,
|
||||
SSL3_ST_CR_FINISHED_B);
|
||||
if (ret <= 0) goto end;
|
||||
@@ -777,6 +778,7 @@ int ssl3_get_server_hello(SSL *s)
|
||||
SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
|
||||
goto f_err;
|
||||
}
|
||||
+ s->s3->flags |= SSL3_FLAGS_CCS_OK;
|
||||
s->hit=1;
|
||||
}
|
||||
else /* a miss or crap from the other end */
|
||||
@@ -2170,6 +2172,13 @@ int ssl3_send_client_key_exchange(SSL *s)
|
||||
int ecdh_clnt_cert = 0;
|
||||
int field_size = 0;
|
||||
|
||||
+ if (s->session->sess_cert == NULL)
|
||||
+ {
|
||||
+ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
|
||||
+ SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
|
||||
+ goto err;
|
||||
+ }
|
||||
+
|
||||
/* Did we send out the client's
|
||||
* ECDH share for use in premaster
|
||||
* computation as part of client certificate?
|
||||
Index: crypto/openssl/ssl/s3_pkt.c
|
||||
===================================================================
|
||||
--- crypto/openssl/ssl/s3_pkt.c (revision 267031)
|
||||
+++ crypto/openssl/ssl/s3_pkt.c (working copy)
|
||||
@@ -1147,6 +1147,15 @@ start:
|
||||
goto f_err;
|
||||
}
|
||||
|
||||
+ if (!(s->s3->flags & SSL3_FLAGS_CCS_OK))
|
||||
+ {
|
||||
+ al=SSL_AD_UNEXPECTED_MESSAGE;
|
||||
+ SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_CCS_RECEIVED_EARLY);
|
||||
+ goto f_err;
|
||||
+ }
|
||||
+
|
||||
+ s->s3->flags &= ~SSL3_FLAGS_CCS_OK;
|
||||
+
|
||||
rr->length=0;
|
||||
|
||||
if (s->msg_callback)
|
||||
@@ -1278,7 +1287,7 @@ int ssl3_do_change_cipher_spec(SSL *s)
|
||||
|
||||
if (s->s3->tmp.key_block == NULL)
|
||||
{
|
||||
- if (s->session == NULL)
|
||||
+ if (s->session == NULL || s->session->master_key_length == 0)
|
||||
{
|
||||
/* might happen if dtls1_read_bytes() calls this */
|
||||
SSLerr(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC,SSL_R_CCS_RECEIVED_EARLY);
|
||||
Index: crypto/openssl/ssl/s3_srvr.c
|
||||
===================================================================
|
||||
--- crypto/openssl/ssl/s3_srvr.c (revision 267031)
|
||||
+++ crypto/openssl/ssl/s3_srvr.c (working copy)
|
||||
@@ -523,6 +523,7 @@ int ssl3_accept(SSL *s)
|
||||
case SSL3_ST_SR_CERT_VRFY_A:
|
||||
case SSL3_ST_SR_CERT_VRFY_B:
|
||||
|
||||
+ s->s3->flags |= SSL3_FLAGS_CCS_OK;
|
||||
/* we should decide if we expected this one */
|
||||
ret=ssl3_get_cert_verify(s);
|
||||
if (ret <= 0) goto end;
|
||||
@@ -533,6 +534,7 @@ int ssl3_accept(SSL *s)
|
||||
|
||||
case SSL3_ST_SR_FINISHED_A:
|
||||
case SSL3_ST_SR_FINISHED_B:
|
||||
+ s->s3->flags |= SSL3_FLAGS_CCS_OK;
|
||||
ret=ssl3_get_finished(s,SSL3_ST_SR_FINISHED_A,
|
||||
SSL3_ST_SR_FINISHED_B);
|
||||
if (ret <= 0) goto end;
|
||||
Index: crypto/openssl/ssl/ssl3.h
|
||||
===================================================================
|
||||
--- crypto/openssl/ssl/ssl3.h (revision 267031)
|
||||
+++ crypto/openssl/ssl/ssl3.h (working copy)
|
||||
@@ -344,6 +344,7 @@ typedef struct ssl3_buffer_st
|
||||
* effected, but we can't prevent that.
|
||||
*/
|
||||
#define SSL3_FLAGS_SGC_RESTART_DONE 0x0040
|
||||
+#define SSL3_FLAGS_CCS_OK 0x0080
|
||||
|
||||
typedef struct ssl3_state_st
|
||||
{
|
||||
17
share/security/patches/SA-14:14/openssl-9.patch.asc
Normal file
17
share/security/patches/SA-14:14/openssl-9.patch.asc
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
-----BEGIN PGP SIGNATURE-----
|
||||
Version: GnuPG v2.0.22 (FreeBSD)
|
||||
|
||||
iQIcBAABCgAGBQJTkGnVAAoJEO1n7NZdz2rnaIoP/2bfZoar991IHEBh8Aold0h2
|
||||
NKG4hfkSwF2wrvewZT0kNaM84XPClx5dWP2AwOMfFgrtzaPzBrVmKCeuUe9yAGNH
|
||||
GqM+mZfEMdGmqEusYwCLiGz/kcNeXXvrCFhAyQx+bIXa1btDOfQ3F3GVeHG6eihl
|
||||
kkywL8dBiSYaaVRECeezROnN0+mlXHM//Yt/+QQkPN38fGBfZ1qdxxXo55a9clCT
|
||||
Iese/UvLp2q/iikMqzXZWcb3uR2y1yvh4RbIfI5kjj3DSMD9QwPr7NDNY37kjC42
|
||||
2t0xLQFrNX24wrFOqJunQvIG9QE33gYQqAFOjPC2rRGVGD3lqLHsKUN0yWHX7ORx
|
||||
Bzf6wKqEy3ewI4MquPYbQ/sfMchHQexMu6IrF5CYhcgeMzk5SFGawHS7FtTlnLxT
|
||||
PrBSdpkr4M7zX0Uv1ztLPyx/iC2MUi9Me7Ic0Sr2nWUyl1wufVRcaqEZhN097nwh
|
||||
q8FqExzRDOAv+3TdGdf2XIuYKzYNrEFKFs35N23QAvzy0HVYfx3y+y5Ob8SY8Z5d
|
||||
R8QHhlf/o2mWgJBdbYVbITc9OP5+dyVw/75BgVMemg15PobTSdQUcVfFdR5UDDFY
|
||||
wy0Vnj/7yAMk/WhRMaZA3aeYWx9J0rgW0CGxNTHbMLttocOk5GmgXUIGmraLlPGR
|
||||
ETLkxDw92ye270FzKYev
|
||||
=QENL
|
||||
-----END PGP SIGNATURE-----
|
||||
Loading…
Add table
Add a link
Reference in a new issue