Skip to content

Commit 1812d32

Browse files
JacobBarthelmehJacobBarthelmeh
authored
Merge pull request #6635 from julek-wolfssl/zd/16403
Fix ClientHello parsing when no extensions are present
2 parents d320260 + d3aa11b commit 1812d32

4 files changed

Lines changed: 309 additions & 225 deletions

File tree

‎src/dtls.c‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -285,10 +285,13 @@ static int ParseClientHello(const byte* input, word32 helloSz, WolfSSL_CH* ch)
285285
if (idx > helloSz - OPAQUE8_LEN)
286286
return BUFFER_ERROR;
287287
idx += ReadVector8(input + idx, &ch->compression);
288-
if (idx > helloSz - OPAQUE16_LEN)
289-
return BUFFER_ERROR;
290-
idx += ReadVector16(input + idx, &ch->extension);
291-
if (idx > helloSz)
288+
if (idx < helloSz - OPAQUE16_LEN) {
289+
/* Extensions are optional */
290+
idx += ReadVector16(input + idx, &ch->extension);
291+
if (idx > helloSz)
292+
return BUFFER_ERROR;
293+
}
294+
if (idx != helloSz)
292295
return BUFFER_ERROR;
293296
ch->length = idx;
294297
return 0;

‎tests/api.c‎

Lines changed: 104 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -10717,7 +10717,8 @@ static int test_wolfSSL_SCR_Reconnect(void)
1071710717
EXPECT_DECLS;
1071810718
#if defined(HAVE_SECURE_RENEGOTIATION) && \
1071910719
defined(BUILD_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) && \
10720-
defined(BUILD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256)
10720+
defined(BUILD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256) && \
10721+
defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES)
1072110722
struct test_memio_ctx test_ctx;
1072210723
WOLFSSL_CTX *ctx_c = NULL, *ctx_s = NULL;
1072310724
WOLFSSL *ssl_c = NULL, *ssl_s = NULL;
@@ -61017,8 +61018,7 @@ static int test_wolfSSL_DTLS_fragment_buckets(void)
6101761018

6101861019
#if !defined(NO_FILESYSTEM) && \
6101961020
defined(WOLFSSL_DTLS) && !defined(WOLFSSL_NO_TLS12) && \
61020-
!defined(NO_WOLFSSL_CLIENT) && !defined(NO_WOLFSSL_SERVER) && \
61021-
!defined(NO_RSA)
61021+
defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES)
6102261022

6102361023
static int test_wolfSSL_dtls_stateless2(void)
6102461024
{
@@ -61241,9 +61241,8 @@ static int test_wolfSSL_dtls_stateless_downgrade(void)
6124161241
#endif /* defined(WOLFSSL_DTLS) && !defined(WOLFSSL_NO_TLS12) && \
6124261242
!defined(NO_WOLFSSL_CLIENT) && !defined(NO_WOLFSSL_SERVER)*/
6124361243

61244-
#if defined(WOLFSSL_DTLS) && !defined(WOLFSSL_NO_TLS12) && \
61245-
!defined(NO_WOLFSSL_CLIENT) && !defined(NO_WOLFSSL_SERVER) && \
61246-
!defined(NO_OLD_TLS) && !defined(NO_RSA)
61244+
#if defined(WOLFSSL_DTLS) && !defined(WOLFSSL_NO_TLS12) && \
61245+
!defined(NO_OLD_TLS) && defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES)
6124761246
static int test_WOLFSSL_dtls_version_alert(void)
6124861247
{
6124961248
EXPECT_DECLS;
@@ -61297,7 +61296,8 @@ static int test_WOLFSSL_dtls_version_alert(void)
6129761296

6129861297
#if defined(WOLFSSL_TICKET_NONCE_MALLOC) && defined(HAVE_SESSION_TICKET) \
6129961298
&& defined(WOLFSSL_TLS13) && \
61300-
(!defined(HAVE_FIPS) || (defined(FIPS_VERSION_GE) && FIPS_VERSION_GE(5,3)))
61299+
(!defined(HAVE_FIPS) || (defined(FIPS_VERSION_GE) && FIPS_VERSION_GE(5,3)))\
61300+
&& defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES)
6130161301
static int send_new_session_ticket(WOLFSSL *ssl, byte nonceLength, byte filler)
6130261302
{
6130361303
struct test_memio_ctx *test_ctx;
@@ -61466,7 +61466,7 @@ static int test_ticket_nonce_malloc(void)
6146661466
!defined(WOLFSSL_TICKET_DECRYPT_NO_CREATE) && \
6146761467
!defined(NO_WOLFSSL_CLIENT) && !defined(NO_WOLFSSL_SERVER) && \
6146861468
!defined(WOLFSSL_NO_DEF_TICKET_ENC_CB) && !defined(NO_RSA) && \
61469-
defined(HAVE_ECC)
61469+
defined(HAVE_ECC) && defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES)
6147061470

6147161471
static int test_ticket_ret_create(void)
6147261472
{
@@ -61924,7 +61924,7 @@ static int test_TLS_13_ticket_different_ciphers(void)
6192461924
}
6192561925
#endif
6192661926
#if defined(WOLFSSL_EXTRA_ALERTS) && !defined(WOLFSSL_NO_TLS12) && \
61927-
defined(HAVE_IO_TESTS_DEPENDENCIES)
61927+
defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES)
6192861928

6192961929
#define TEST_WRONG_CS_CLIENT "DHE-RSA-AES128-SHA"
6193061930
/* AKA TLS_DHE_RSA_WITH_AES_128_CBC_SHA */
@@ -61990,7 +61990,7 @@ static int test_extra_alerts_wrong_cs(void)
6199061990
#endif
6199161991

6199261992
#if !defined(WOLFSSL_NO_TLS12) && defined(WOLFSSL_EXTRA_ALERTS) && \
61993-
defined(HAVE_IO_TESTS_DEPENDENCIES) && !defined(WOLFSSL_SP_MATH)
61993+
defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES) && !defined(WOLFSSL_SP_MATH)
6199461994

6199561995
static void test_remove_msg(byte *msg, int tail_len, int *len, int msg_length)
6199661996
{
@@ -62149,8 +62149,8 @@ static int test_extra_alerts_skip_hs(void)
6214962149
}
6215062150
#endif
6215162151

62152-
#if !defined(WOLFSSL_NO_TLS12) && defined(HAVE_IO_TESTS_DEPENDENCIES) && \
62153-
defined(WOLFSSL_EXTRA_ALERTS) && !defined(NO_PSK) && !defined(NO_DH)
62152+
#if !defined(WOLFSSL_NO_TLS12) && defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES)\
62153+
&& defined(WOLFSSL_EXTRA_ALERTS) && !defined(NO_PSK) && !defined(NO_DH)
6215462154

6215562155
static unsigned int test_server_psk_cb(WOLFSSL* ssl, const char* id,
6215662156
unsigned char* key, unsigned int key_max_len)
@@ -62401,7 +62401,7 @@ static int test_override_alt_cert_chain(void)
6240162401
}
6240262402
#endif
6240362403

62404-
#if defined(HAVE_IO_TESTS_DEPENDENCIES) && defined(WOLFSSL_DTLS13)
62404+
#if defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES) && defined(WOLFSSL_DTLS13)
6240562405

6240662406

6240762407
static int test_dtls13_bad_epoch_ch(void)
@@ -62544,8 +62544,8 @@ static int test_short_session_id(void)
6254462544
}
6254562545
#endif
6254662546

62547-
#if defined(HAVE_NULL_CIPHER) && defined(HAVE_IO_TESTS_DEPENDENCIES) && \
62548-
defined(WOLFSSL_DTLS13)
62547+
#if defined(HAVE_NULL_CIPHER) && defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES) \
62548+
&& defined(WOLFSSL_DTLS13)
6254962549
static byte* test_find_string(const char *string,
6255062550
byte *buf, int buf_size)
6255162551
{
@@ -62854,6 +62854,94 @@ static int test_wolfSSL_configure_args(void)
6285462854
#endif
6285562855
return EXPECT_RESULT();
6285662856
}
62857+
62858+
static int test_dtls_no_extensions(void)
62859+
{
62860+
EXPECT_DECLS;
62861+
#if defined(WOLFSSL_DTLS) && defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES)
62862+
WOLFSSL *ssl_s = NULL;
62863+
WOLFSSL_CTX *ctx_s = NULL;
62864+
struct test_memio_ctx test_ctx;
62865+
const byte chNoExtensions[] = {
62866+
/* Handshake type */
62867+
0x16,
62868+
/* Version */
62869+
0xfe, 0xff,
62870+
/* Epoch */
62871+
0x00, 0x00,
62872+
/* Seq number */
62873+
0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
62874+
/* Length */
62875+
0x00, 0x40,
62876+
/* CH type */
62877+
0x01,
62878+
/* Length */
62879+
0x00, 0x00, 0x34,
62880+
/* Msg Seq */
62881+
0x00, 0x00,
62882+
/* Frag offset */
62883+
0x00, 0x00, 0x00,
62884+
/* Frag length */
62885+
0x00, 0x00, 0x34,
62886+
/* Version */
62887+
0xfe, 0xff,
62888+
/* Random */
62889+
0x62, 0xfe, 0xbc, 0xfe, 0x2b, 0xfe, 0x3f, 0xeb, 0x03, 0xc4, 0xea, 0x37,
62890+
0xe7, 0x47, 0x7e, 0x8a, 0xd9, 0xbf, 0x77, 0x0f, 0x6c, 0xb6, 0x77, 0x0b,
62891+
0x03, 0x3f, 0x82, 0x2b, 0x21, 0x64, 0x57, 0x1d,
62892+
/* Session Length */
62893+
0x00,
62894+
/* Cookie Length */
62895+
0x00,
62896+
/* CS Length */
62897+
0x00, 0x0c,
62898+
/* CS */
62899+
0xc0, 0x0a, 0xc0, 0x09, 0xc0, 0x14, 0xc0, 0x13, 0x00, 0x39, 0x00, 0x33,
62900+
/* Comp Meths Length */
62901+
0x01,
62902+
/* Comp Meths */
62903+
0x00
62904+
/* And finally... no extensions */
62905+
};
62906+
int i;
62907+
#ifdef OPENSSL_EXTRA
62908+
int repeats = 2;
62909+
#else
62910+
int repeats = 1;
62911+
#endif
62912+
62913+
for (i = 0; i < repeats; i++) {
62914+
XMEMSET(&test_ctx, 0, sizeof(test_ctx));
62915+
ssl_s = NULL;
62916+
ctx_s = NULL;
62917+
62918+
ExpectIntEQ(test_memio_setup(&test_ctx, NULL, &ctx_s, NULL, &ssl_s,
62919+
NULL, wolfDTLS_server_method), 0);
62920+
62921+
XMEMCPY(test_ctx.s_buff, chNoExtensions, sizeof(chNoExtensions));
62922+
test_ctx.s_len = sizeof(chNoExtensions);
62923+
62924+
#ifdef OPENSSL_EXTRA
62925+
if (i > 0) {
62926+
ExpectIntEQ(wolfSSL_set_max_proto_version(ssl_s, DTLS1_2_VERSION),
62927+
WOLFSSL_SUCCESS);
62928+
}
62929+
#endif
62930+
62931+
ExpectIntEQ(wolfSSL_accept(ssl_s), -1);
62932+
ExpectIntEQ(wolfSSL_get_error(ssl_s, -1), WOLFSSL_ERROR_WANT_READ);
62933+
62934+
/* Expecting a handshake msg. Either HVR or SH. */
62935+
ExpectIntGT(test_ctx.c_len, 0);
62936+
ExpectIntEQ(test_ctx.c_buff[0], 0x16);
62937+
62938+
wolfSSL_free(ssl_s);
62939+
wolfSSL_CTX_free(ctx_s);
62940+
}
62941+
#endif
62942+
return EXPECT_RESULT();
62943+
}
62944+
6285762945
/*----------------------------------------------------------------------------*
6285862946
| Main
6285962947
*----------------------------------------------------------------------------*/
@@ -64103,6 +64191,7 @@ TEST_CASE testCases[] = {
6410364191
TEST_DECL(test_dtls_msg_from_other_peer),
6410464192
TEST_DECL(test_dtls_ipv6_check),
6410564193
TEST_DECL(test_wolfSSL_SCR_after_resumption),
64194+
TEST_DECL(test_dtls_no_extensions),
6410664195
/* This test needs to stay at the end to clean up any caches allocated. */
6410764196
TEST_DECL(test_wolfSSL_Cleanup)
6410864197
};

0 commit comments

Comments
 (0)