wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-08-03 04:34:41 +02:00
Code Issues Packages Projects Releases Wiki Activity

wolfio: dtls: fix incorrect peer matching check

Browse Source 
Ignore packet if coming from a peer of a different size *or* from a different
peer. Avoid whole memcmp of sockaddr_in[6] struct because is not portable (there
are optional fields in struct sockaddr_in).
This commit is contained in:
Marco Oliverio
2022-05-05 18:24:20 +02:00
parent 27e73818c5
commit 6df65c0162
1 changed files with 51 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

54
src/wolfio.c
View File

@@ -320,6 +320,53 @@ int EmbedSend(WOLFSSL* ssl, char *buf, int sz, void *ctx)
#define SENDTO_FUNCTION sendto
#define RECVFROM_FUNCTION recvfrom
static int sockAddrEqual(
SOCKADDR_S *a, XSOCKLENT aLen, SOCKADDR_S *b, XSOCKLENT bLen)
{
if (aLen != bLen)
return 0;
if (a->ss_family != b->ss_family)
return 0;
if (a->ss_family == AF_INET) {
if (aLen < sizeof(SOCKADDR_IN))
return 0;
if (((SOCKADDR_IN*)a)->sin_port != ((SOCKADDR_IN*)b)->sin_port)
return 0;
if (((SOCKADDR_IN*)a)->sin_addr.s_addr !=
((SOCKADDR_IN*)b)->sin_addr.s_addr)
return 0;
return 1;
}
#ifdef WOLFSSL_IPV6
if (a->ss_family == AF_INET6) {
SOCKADDR_IN6 *a6, *b6;
if (aLen < sizeof(SOCKADDR_IN6))
return 0;
a6 = (SOCKADDR_IN6*)a;
b6 = (SOCKADDR_IN6*)b;
if (((SOCKADDR_IN6*)a)->sin6_port != ((SOCKADDR_IN6*)b)->sin6_port)
return 0;
if (XMEMCMP((void*)&a6->sin6_addr, (void*)&b6->sin6_addr,
sizeof(a6->sin6_addr)) != 0)
return 0;
return 1;
}
#endif /* WOLFSSL_HAVE_IPV6 */
return 0;
}
/* The receive embedded callback
* return : nb bytes read, or error
@@ -381,9 +428,10 @@ int EmbedReceiveFrom(WOLFSSL *ssl, char *buf, int sz, void *ctx)
return recvd;
}
else {
if (dtlsCtx->peer.sz > 0
&& peerSz != (XSOCKLENT)dtlsCtx->peer.sz
&& XMEMCMP(&peer, dtlsCtx->peer.sa, peerSz) != 0) {
if (dtlsCtx->peer.sz > 0 &&
(peerSz != (XSOCKLENT)dtlsCtx->peer.sz ||
!sockAddrEqual(&peer, peerSz, (SOCKADDR_S*)dtlsCtx->peer.sa,
dtlsCtx->peer.sz))) {
WOLFSSL_MSG(" Ignored packet from invalid peer");
return WOLFSSL_CBIO_ERR_WANT_READ;
}