Skip to content

Commit bc4bec6

Browse files
JacobBarthelmehJacobBarthelmeh
authored
Merge pull request #10094 from sebastian-carpenter/GH-10068
Fixes: for GH #10068
2 parents c098e53 + 9a161a6 commit bc4bec6

6 files changed

Lines changed: 769 additions & 168 deletions

File tree

‎src/ssl_ech.c‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -547,8 +547,9 @@ int SetEchConfigsEx(WOLFSSL_EchConfig** outputConfigs, void* heap,
547547
ato16(echConfig, &hpkePubkeyLen);
548548
echConfig += 2;
549549

550-
/* hpke public_key */
551-
if (hpkePubkeyLen > HPKE_Npk_MAX || hpkePubkeyLen == 0) {
550+
/* hpke public_key
551+
* KEM support will be checked along with the ciphersuites */
552+
if (hpkePubkeyLen != wc_HpkeKemGetEncLen(workingConfig->kemId)) {
552553
ret = BUFFER_E;
553554
break;
554555
}

‎src/tls.c‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13800,7 +13800,7 @@ static int TLSX_ECH_Write(WOLFSSL_ECH* ech, byte msgType, byte* writeBuf,
1380013800
writeBuf_p += ech->encLen;
1380113801
}
1380213802
/* innerClientHelloLen */
13803-
c16toa(ech->innerClientHelloLen, writeBuf_p);
13803+
c16toa((word16)ech->innerClientHelloLen, writeBuf_p);
1380413804
writeBuf_p += 2;
1380513805
/* set payload offset for when we finalize */
1380613806
ech->outerClientPayload = writeBuf_p;
@@ -14195,6 +14195,9 @@ static int TLSX_ECH_ExpandOuterExtensions(WOLFSSL* ssl, WOLFSSL_ECH* ech,
1419514195

1419614196
newInnerChLen = innerChLen - echOuterExtLen + extraSize - sessionIdLen +
1419714197
ssl->session->sessionIDSz;
14198+
if (newInnerChLen > 0xFFFF) {
14199+
return BUFFER_E;
14200+
}
1419814201

1419914202
if (!foundEchOuter && sessionIdLen == ssl->session->sessionIDSz) {
1420014203
/* no extensions + no sessionID to copy */
@@ -14259,7 +14262,7 @@ static int TLSX_ECH_ExpandOuterExtensions(WOLFSSL* ssl, WOLFSSL_ECH* ech,
1425914262
if (ret == 0) {
1426014263
XFREE(ech->innerClientHello, heap, DYNAMIC_TYPE_TMP_BUFFER);
1426114264
ech->innerClientHello = newInnerCh;
14262-
ech->innerClientHelloLen = (word16)newInnerChLen;
14265+
ech->innerClientHelloLen = newInnerChLen;
1426314266
newInnerCh = NULL;
1426414267
}
1426514268

@@ -14373,6 +14376,7 @@ static int TLSX_ECH_Parse(WOLFSSL* ssl, const byte* readBuf, word16 size,
1437314376
word32 offset = 0;
1437414377
word16 len;
1437514378
word16 tmpVal16;
14379+
word16 lenCh;
1437614380

1437714381
WOLFSSL_MSG("TLSX_ECH_Parse");
1437814382
if (ssl->options.disableECH) {
@@ -14489,7 +14493,8 @@ static int TLSX_ECH_Parse(WOLFSSL* ssl, const byte* readBuf, word16 size,
1448914493
readBuf_p += len;
1449014494
offset += len;
1449114495
/* read payload (encrypted CH) len */
14492-
ato16(readBuf_p, &ech->innerClientHelloLen);
14496+
ato16(readBuf_p, &lenCh);
14497+
ech->innerClientHelloLen = lenCh;
1449314498
readBuf_p += 2;
1449414499
offset += 2;
1449514500
/* Check payload is no bigger than remaining bytes. */

‎src/tls13.c‎

Lines changed: 31 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3805,6 +3805,7 @@ int EchConfigGetSupportedCipherSuite(WOLFSSL_EchConfig* config)
38053805
int i = 0;
38063806

38073807
if (!wc_HpkeKemIsSupported(config->kemId)) {
3808+
WOLFSSL_MSG("ECH config: KEM not supported");
38083809
return WOLFSSL_FATAL_ERROR;
38093810
}
38103811

@@ -3815,6 +3816,7 @@ int EchConfigGetSupportedCipherSuite(WOLFSSL_EchConfig* config)
38153816
}
38163817
}
38173818

3819+
WOLFSSL_MSG("ECH config: KDF or AEAD not supported");
38183820
return WOLFSSL_FATAL_ERROR;
38193821
}
38203822

@@ -3937,10 +3939,14 @@ static int EchCalcAcceptance(WOLFSSL* ssl, byte* label, word16 labelSz,
39373939

39383940
if (isHrr) {
39393941
/* the transcript hash of ClientHelloInner1 */
3940-
hashSz = GetMsgHash(ssl, clientHelloInnerHash);
3941-
if (hashSz > 0) {
3942+
ret = GetMsgHash(ssl, clientHelloInnerHash);
3943+
if (ret > 0) {
3944+
hashSz = ret;
39423945
ret = 0;
39433946
}
3947+
else if (ret == 0) {
3948+
ret = HASH_TYPE_E;
3949+
}
39443950

39453951
/* restart ECH transcript hash, similar to RestartHandshakeHash but
39463952
* don't add a cookie */
@@ -3980,6 +3986,9 @@ static int EchCalcAcceptance(WOLFSSL* ssl, byte* label, word16 labelSz,
39803986
if (ret > 0) {
39813987
ret = 0;
39823988
}
3989+
else if (ret == 0) {
3990+
ret = HASH_TYPE_E;
3991+
}
39833992
}
39843993

39853994
/* pick the right type and size based on mac_algorithm */
@@ -4765,15 +4774,18 @@ int SendTls13ClientHello(WOLFSSL* ssl)
47654774

47664775
/* get size for inner */
47674776
ret = TLSX_GetRequestSize(ssl, client_hello, &args->length);
4777+
4778+
/* set the type to outer */
4779+
args->ech->type = ECH_TYPE_OUTER;
47684780
if (ret != 0)
47694781
return ret;
47704782

4771-
/* set the type to outer */
4772-
args->ech->type = 0;
47734783
/* set innerClientHelloLen to ClientHelloInner + padding + tag */
47744784
args->ech->paddingLen = 31 - ((args->length - 1) % 32);
4775-
args->ech->innerClientHelloLen = (word16)(args->length +
4776-
args->ech->paddingLen + args->ech->hpke->Nt);
4785+
args->ech->innerClientHelloLen = args->length +
4786+
args->ech->paddingLen + args->ech->hpke->Nt;
4787+
if (args->ech->innerClientHelloLen > 0xFFFF)
4788+
return BUFFER_E;
47774789
/* set the length back to before we computed ClientHelloInner size */
47784790
args->length = (word32)args->preXLength;
47794791
}
@@ -4915,8 +4927,10 @@ int SendTls13ClientHello(WOLFSSL* ssl)
49154927
args->ech->innerClientHello =
49164928
(byte*)XMALLOC(args->ech->innerClientHelloLen - args->ech->hpke->Nt,
49174929
ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
4918-
if (args->ech->innerClientHello == NULL)
4930+
if (args->ech->innerClientHello == NULL) {
4931+
args->ech->type = ECH_TYPE_OUTER;
49194932
return MEMORY_E;
4933+
}
49204934
/* set the padding bytes to 0 */
49214935
XMEMSET(args->ech->innerClientHello + args->ech->innerClientHelloLen -
49224936
args->ech->hpke->Nt - args->ech->paddingLen, 0,
@@ -4939,8 +4953,10 @@ int SendTls13ClientHello(WOLFSSL* ssl)
49394953
/* change the outer client random */
49404954
ret = wc_RNG_GenerateBlock(ssl->rng, args->output +
49414955
args->clientRandomOffset, RAN_LEN);
4942-
if (ret != 0)
4956+
if (ret != 0) {
4957+
args->ech->type = ECH_TYPE_OUTER;
49434958
return ret;
4959+
}
49444960
/* copy the new client random */
49454961
XMEMCPY(ssl->arrays->clientRandom, args->output +
49464962
args->clientRandomOffset, RAN_LEN);
@@ -4949,10 +4965,10 @@ int SendTls13ClientHello(WOLFSSL* ssl)
49494965
ret = TLSX_WriteRequest(ssl, args->ech->innerClientHello + args->idx -
49504966
(RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ), client_hello,
49514967
&args->length);
4968+
/* set the type to outer */
4969+
args->ech->type = ECH_TYPE_OUTER;
49524970
if (ret != 0)
49534971
return ret;
4954-
/* set the type to outer */
4955-
args->ech->type = 0;
49564972
}
49574973
#endif
49584974

@@ -5707,6 +5723,9 @@ int DoTls13ServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
57075723
/* check for acceptConfirmation */
57085724
if (ssl->echConfigs != NULL && !ssl->options.disableECH) {
57095725
args->echX = TLSX_Find(ssl->extensions, TLSX_ECH);
5726+
if (args->echX == NULL || args->echX->data == NULL)
5727+
return WOLFSSL_FATAL_ERROR;
5728+
57105729
/* account for hrr extension instead of server random */
57115730
if (args->extMsgType == hello_retry_request) {
57125731
args->acceptOffset =
@@ -8815,6 +8834,8 @@ int CreateSigData(WOLFSSL* ssl, byte* sigData, word16* sigDataSz,
88158834
ret = GetMsgHash(ssl, &sigData[idx]);
88168835
if (ret < 0)
88178836
return ret;
8837+
if (ret == 0)
8838+
return HASH_TYPE_E;
88188839

88198840
*sigDataSz = (word16)(idx + ret);
88208841
ret = 0;

‎wolfcrypt/src/hpke.c‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -917,7 +917,7 @@ int wc_HpkeInitSealContext(Hpke* hpke, HpkeBaseContext* context,
917917
void* ephemeralKey, void* receiverKey, byte* info, word32 infoSz)
918918
{
919919
if (hpke == NULL || context == NULL || ephemeralKey == NULL ||
920-
receiverKey == NULL || (info == NULL && infoSz > 0)) {
920+
receiverKey == NULL || (info == NULL && infoSz != 0)) {
921921
return BAD_FUNC_ARG;
922922
}
923923

@@ -935,7 +935,7 @@ int wc_HpkeContextSealBase(Hpke* hpke, HpkeBaseContext* context,
935935
int ret;
936936
byte nonce[HPKE_Nn_MAX];
937937
WC_DECLARE_VAR(aes, Aes, 1, 0);
938-
if (hpke == NULL || context == NULL || (aad == NULL && aadSz > 0) ||
938+
if (hpke == NULL || context == NULL || (aad == NULL && aadSz != 0) ||
939939
plaintext == NULL || out == NULL) {
940940
return BAD_FUNC_ARG;
941941
}
@@ -1160,7 +1160,7 @@ int wc_HpkeInitOpenContext(Hpke* hpke, HpkeBaseContext* context,
11601160
word32 infoSz)
11611161
{
11621162
if (hpke == NULL || context == NULL || receiverKey == NULL || pubKey == NULL
1163-
|| (info == NULL && infoSz > 0)) {
1163+
|| (info == NULL && infoSz != 0)) {
11641164
return BAD_FUNC_ARG;
11651165
}
11661166

@@ -1175,7 +1175,8 @@ int wc_HpkeContextOpenBase(Hpke* hpke, HpkeBaseContext* context, byte* aad,
11751175
int ret;
11761176
byte nonce[HPKE_Nn_MAX];
11771177
WC_DECLARE_VAR(aes, Aes, 1, 0);
1178-
if (hpke == NULL || context == NULL || ciphertext == NULL || out == NULL) {
1178+
if (hpke == NULL || context == NULL || (aad == NULL && aadSz != 0) ||
1179+
ciphertext == NULL || out == NULL) {
11791180
return BAD_FUNC_ARG;
11801181
}
11811182

0 commit comments

Comments
 (0)