Signed-off-by: Steffen Trumtrar <[email protected]> --- ...-max_frag_len-checking-if-no-Max-Fragment.patch | 41 ++++++++++++++++++++++ patches/openssl-3.2.0/series | 3 +- 2 files changed, 43 insertions(+), 1 deletion(-)
diff --git a/patches/openssl-3.2.0/0006-Don-t-apply-max_frag_len-checking-if-no-Max-Fragment.patch b/patches/openssl-3.2.0/0006-Don-t-apply-max_frag_len-checking-if-no-Max-Fragment.patch new file mode 100644 index 000000000..814bd07be --- /dev/null +++ b/patches/openssl-3.2.0/0006-Don-t-apply-max_frag_len-checking-if-no-Max-Fragment.patch @@ -0,0 +1,41 @@ +From: Matt Caswell <[email protected]> +Date: Tue, 2 Jan 2024 16:48:43 +0000 +Subject: [PATCH] Don't apply max_frag_len checking if no Max Fragment Length + extension + +Don't check the Max Fragment Length if the it hasn't been negotiated. We +were checking it anyway, and using the default value +(SSL3_RT_MAX_PLAIN_LENGTH). This works in most cases but KTLS can cause the +record length to actually exceed this in some cases. + +Fixes #23169 +--- + ssl/record/methods/tls_common.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/ssl/record/methods/tls_common.c b/ssl/record/methods/tls_common.c +index 423777c18dd4..1a9320ae74de 100644 +--- a/ssl/record/methods/tls_common.c ++++ b/ssl/record/methods/tls_common.c +@@ -910,11 +910,17 @@ int tls_get_more_records(OSSL_RECORD_LAYER *rl) + } + + /* +- * Check if the received packet overflows the current +- * Max Fragment Length setting. +- * Note: rl->max_frag_len > 0 and KTLS are mutually exclusive. ++ * Record overflow checking (e.g. checking if ++ * thisrr->length > SSL3_RT_MAX_PLAIN_LENGTH) is the responsibility of ++ * the post_process_record() function above. However we check here if ++ * the received packet overflows the current Max Fragment Length setting ++ * if there is one. ++ * Note: rl->max_frag_len != SSL3_RT_MAX_PLAIN_LENGTH and KTLS are ++ * mutually exclusive. Also note that with KTLS thisrr->length can ++ * be > SSL3_RT_MAX_PLAIN_LENGTH (and rl->max_frag_len must be ignored) + */ +- if (thisrr->length > rl->max_frag_len) { ++ if (rl->max_frag_len != SSL3_RT_MAX_PLAIN_LENGTH ++ && thisrr->length > rl->max_frag_len) { + RLAYERfatal(rl, SSL_AD_RECORD_OVERFLOW, SSL_R_DATA_LENGTH_TOO_LONG); + goto end; + } diff --git a/patches/openssl-3.2.0/series b/patches/openssl-3.2.0/series index d655cfc02..75c75e0cf 100644 --- a/patches/openssl-3.2.0/series +++ b/patches/openssl-3.2.0/series @@ -5,4 +5,5 @@ 0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch 0004-conf-Serialize-allocation-free-of-ssl_names.patch 0005-Configure-drop-fzero-call-used-regs-used-gpr-from-De.patch -# c935d671c5de74f0dec935f1f45438cc - git-ptx-patches magic +0006-Don-t-apply-max_frag_len-checking-if-no-Max-Fragment.patch +# 224889bac59e4b20f72cdb177f2d29c8 - git-ptx-patches magic -- 2.43.0
