Changeset 95219 in vbox for trunk/src/libs/openssl-3.0.3/ssl/statem

Timestamp:

Jun 8, 2022 7:43:44 AM (3 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

151730

Message:

libs/openssl: Switched to v3.0.3, bugref:10128

Location:

trunk/src/libs/openssl-3.0.3

Files:

• . (modified) (1 prop)
• ssl/statem/statem_clnt.c (modified) (1 diff)
• ssl/statem/statem_dtls.c (modified) (3 diffs)
• ssl/statem/statem_srvr.c (modified) (1 diff)

trunk/src/libs/openssl-3.0.3

@@ -14 +14 @@
 /vendor/openssl/3.0.1:150323-150324
 /vendor/openssl/3.0.2:150728-150729
-/vendor/openssl/current:147554-150727
+/vendor/openssl/3.0.3:151497-151729
+/vendor/openssl/current:147554-151496

@@ -14 +14 @@
 /vendor/openssl/3.0.1:150323-150324
 /vendor/openssl/3.0.2:150728-150729
-/vendor/openssl/current:147554-150727
+/vendor/openssl/3.0.3:151497-151729
+/vendor/openssl/current:147554-151496

trunk/src/libs/openssl-3.0.3/ssl/statem/statem_clnt.c

@@ -1396 +1396 @@
             && PACKET_remaining(pkt) >= SSL3_RANDOM_SIZE
             && memcmp(hrrrandom, PACKET_data(pkt), SSL3_RANDOM_SIZE) == 0) {
+        if (s->hello_retry_request != SSL_HRR_NONE) {
+            SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
+            goto err;
+        }
         s->hello_retry_request = SSL_HRR_PENDING;
         hrr = 1;

trunk/src/libs/openssl-3.0.3/ssl/statem/statem_dtls.c

@@ -1 +1 @@
 /*
- * Copyright 2005-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2005-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -219 +219 @@
             len = s->init_num;
 
-        if (len > s->max_send_fragment)
-            len = s->max_send_fragment;
+        if (len > ssl_get_max_send_fragment(s))
+            len = ssl_get_max_send_fragment(s);
 
         /*
@@ -242 +242 @@
         ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off], len,
                                 &written);
-        if (ret < 0) {
+        if (ret <= 0) {
             /*
              * might need to update MTU here, but we don't know which

trunk/src/libs/openssl-3.0.3/ssl/statem/statem_srvr.c

@@ -3622 +3622 @@
                                  unsigned char *tick_nonce)
 {
+    uint32_t timeout = (uint32_t)s->session->timeout;
+
     /*
-     * Ticket lifetime hint: For TLSv1.2 this is advisory only and we leave this
-     * unspecified for resumed session (for simplicity).
+     * Ticket lifetime hint:
      * In TLSv1.3 we reset the "time" field above, and always specify the
-     * timeout.
+     * timeout, limited to a 1 week period per RFC8446.
+     * For TLSv1.2 this is advisory only and we leave this unspecified for
+     * resumed session (for simplicity).
      */
-    if (!WPACKET_put_bytes_u32(pkt,
-                               (s->hit && !SSL_IS_TLS13(s))
-                               ? 0 : (uint32_t)s->session->timeout)) {
+#define ONE_WEEK_SEC (7 * 24 * 60 * 60)
+
+    if (SSL_IS_TLS13(s)) {
+        if (s->session->timeout > ONE_WEEK_SEC)
+            timeout = ONE_WEEK_SEC;
+    } else if (s->hit)
+        timeout = 0;
+
+    if (!WPACKET_put_bytes_u32(pkt, timeout)) {
         SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
         return 0;

@@ -14 +14 @@
 /vendor/openssl/3.0.1:150323-150324
 /vendor/openssl/3.0.2:150728-150729
-/vendor/openssl/current:147554-150727
+/vendor/openssl/3.0.3:151497-151729
+/vendor/openssl/current:147554-151496