From 2a9f5cdb5b5312ddcf16e99a09e164730495d0a0 Mon Sep 17 00:00:00 2001 From: tb <> Date: Mon, 1 Jun 2020 07:59:49 +0000 Subject: Add a mechanism to set an alert in those parts of the read half of the record layer that don't do I/O themselves. Use this mechanism to send a record overflow alert for messages that have overlong plaintext or inner plaintext. Fixes most of the remaining record-layer-limits failures of tlsfuzzer. ok jsing --- src/lib/libssl/tls13_record_layer.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) (limited to 'src/lib') diff --git a/src/lib/libssl/tls13_record_layer.c b/src/lib/libssl/tls13_record_layer.c index 5e6f8e1e5b..6c48c93f08 100644 --- a/src/lib/libssl/tls13_record_layer.c +++ b/src/lib/libssl/tls13_record_layer.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls13_record_layer.c,v 1.47 2020/05/29 17:54:58 jsing Exp $ */ +/* $OpenBSD: tls13_record_layer.c,v 1.48 2020/06/01 07:59:49 tb Exp $ */ /* * Copyright (c) 2018, 2019 Joel Sing * @@ -52,6 +52,9 @@ struct tls13_record_layer { size_t wrec_appdata_len; size_t wrec_content_len; + /* Alert to be sent on return from current read handler. */ + uint8_t alert; + /* Pending alert messages. */ uint8_t *alert_data; size_t alert_len; @@ -504,6 +507,11 @@ tls13_record_layer_open_record_plaintext(struct tls13_record_layer *rl) if (!tls13_record_content(rl->rrec, &cbs)) return 0; + if (CBS_len(&cbs) > TLS13_RECORD_MAX_PLAINTEXT_LEN) { + rl->alert = SSL_AD_RECORD_OVERFLOW; + return 0; + } + tls13_record_layer_rbuf_free(rl); if (!CBS_stow(&cbs, &rl->rbuf, &rl->rbuf_len)) @@ -548,8 +556,10 @@ tls13_record_layer_open_record_protected(struct tls13_record_layer *rl) CBS_data(&header), CBS_len(&header))) goto err; - if (out_len > TLS13_RECORD_MAX_INNER_PLAINTEXT_LEN) + if (out_len > TLS13_RECORD_MAX_INNER_PLAINTEXT_LEN) { + rl->alert = SSL_AD_RECORD_OVERFLOW; goto err; + } if (!tls13_record_layer_inc_seq_num(rl->read_seq_num)) goto err; @@ -565,8 +575,10 @@ tls13_record_layer_open_record_protected(struct tls13_record_layer *rl) content_len--; if (content_len < 0) goto err; - if (content_len > TLS13_RECORD_MAX_PLAINTEXT_LEN) + if (content_len > TLS13_RECORD_MAX_PLAINTEXT_LEN) { + rl->alert = SSL_AD_RECORD_OVERFLOW; goto err; + } content_type = content[content_len]; tls13_record_layer_rbuf_free(rl); @@ -995,6 +1007,9 @@ tls13_record_layer_peek(struct tls13_record_layer *rl, uint8_t content_type, ret = tls13_record_layer_read_internal(rl, content_type, buf, n, 1); } while (ret == TLS13_IO_WANT_RETRY); + if (rl->alert != 0) + return tls13_send_alert(rl, rl->alert); + return ret; } @@ -1008,6 +1023,9 @@ tls13_record_layer_read(struct tls13_record_layer *rl, uint8_t content_type, ret = tls13_record_layer_read_internal(rl, content_type, buf, n, 0); } while (ret == TLS13_IO_WANT_RETRY); + if (rl->alert != 0) + return tls13_send_alert(rl, rl->alert); + return ret; } -- cgit v1.2.3-55-g6feb