wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-08-03 04:34:41 +02:00
Code Issues Packages Projects Releases Wiki Activity

Don't allow sniffer to decrypt records if the key hasn't been setup. (Possible with misbehaving client.)

Browse Source
This commit is contained in:
John Safranek
2014-08-19 22:38:04 -07:00
parent 7e6b3a86d5
commit 100f0e8a96
3 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
cyassl/sniffer_error.h
View File

@@ -103,6 +103,7 @@
#define ACK_MISSED_STR 69 #define ACK_MISSED_STR 69
#define BAD_DECRYPT 70 #define BAD_DECRYPT 70
#define DECRYPT_KEYS_NOT_SETUP 71
/* !!!! also add to msgTable in sniffer.c and .rc file !!!! */ /* !!!! also add to msgTable in sniffer.c and .rc file !!!! */

2
cyassl/sniffer_error.rc
View File

@@ -84,5 +84,7 @@ STRINGTABLE
68, "Bad DeriveKeys Error" 68, "Bad DeriveKeys Error"
69, "Saw ACK for Missing Packet Error" 69, "Saw ACK for Missing Packet Error"
70, "Bad Decrypt Operation" 70, "Bad Decrypt Operation"
71, "Decrypt Keys Not Set Up"
} }

9
src/sniffer.c
View File

@@ -225,7 +225,10 @@ static const char* const msgTable[] =
"Bad Compression Type", "Bad Compression Type",
"Bad DeriveKeys Error", "Bad DeriveKeys Error",
"Saw ACK for Missing Packet Error", "Saw ACK for Missing Packet Error",
"Bad Decrypt Operation" "Bad Decrypt Operation",
/* 71 */
"Decrypt Keys Not Set Up"
}; };
@@ -2378,6 +2381,10 @@ doMessage:
session->flags.serverCipherOn) session->flags.serverCipherOn)
|| (session->flags.side == CYASSL_CLIENT_END && || (session->flags.side == CYASSL_CLIENT_END &&
session->flags.clientCipherOn)) { session->flags.clientCipherOn)) {
if (ssl->decrypt.setup != 1) {
SetError(DECRYPT_KEYS_NOT_SETUP, error, session, FATAL_ERROR_STATE);
return -1;
}
if (CheckAvailableSize(ssl, rhSize) < 0) { if (CheckAvailableSize(ssl, rhSize) < 0) {
SetError(MEMORY_STR, error, session, FATAL_ERROR_STATE); SetError(MEMORY_STR, error, session, FATAL_ERROR_STATE);
return -1; return -1;