On Mon, Jan 22, 2024 at 09:48:26AM +0100, Steffen Trumtrar wrote: > Signed-off-by: Steffen Trumtrar <[email protected]>
What's the upstream status of this patch? Michael > --- > ...-max_frag_len-checking-if-no-Max-Fragment.patch | 41 > ++++++++++++++++++++++ > patches/openssl-3.2.0/series | 3 +- > 2 files changed, 43 insertions(+), 1 deletion(-) > > diff --git > a/patches/openssl-3.2.0/0006-Don-t-apply-max_frag_len-checking-if-no-Max-Fragment.patch > > b/patches/openssl-3.2.0/0006-Don-t-apply-max_frag_len-checking-if-no-Max-Fragment.patch > new file mode 100644 > index 000000000..814bd07be > --- /dev/null > +++ > b/patches/openssl-3.2.0/0006-Don-t-apply-max_frag_len-checking-if-no-Max-Fragment.patch > @@ -0,0 +1,41 @@ > +From: Matt Caswell <[email protected]> > +Date: Tue, 2 Jan 2024 16:48:43 +0000 > +Subject: [PATCH] Don't apply max_frag_len checking if no Max Fragment Length > + extension > + > +Don't check the Max Fragment Length if the it hasn't been negotiated. We > +were checking it anyway, and using the default value > +(SSL3_RT_MAX_PLAIN_LENGTH). This works in most cases but KTLS can cause the > +record length to actually exceed this in some cases. > + > +Fixes #23169 > +--- > + ssl/record/methods/tls_common.c | 14 ++++++++++---- > + 1 file changed, 10 insertions(+), 4 deletions(-) > + > +diff --git a/ssl/record/methods/tls_common.c > b/ssl/record/methods/tls_common.c > +index 423777c18dd4..1a9320ae74de 100644 > +--- a/ssl/record/methods/tls_common.c > ++++ b/ssl/record/methods/tls_common.c > +@@ -910,11 +910,17 @@ int tls_get_more_records(OSSL_RECORD_LAYER *rl) > + } > + > + /* > +- * Check if the received packet overflows the current > +- * Max Fragment Length setting. > +- * Note: rl->max_frag_len > 0 and KTLS are mutually exclusive. > ++ * Record overflow checking (e.g. checking if > ++ * thisrr->length > SSL3_RT_MAX_PLAIN_LENGTH) is the responsibility > of > ++ * the post_process_record() function above. However we check here > if > ++ * the received packet overflows the current Max Fragment Length > setting > ++ * if there is one. > ++ * Note: rl->max_frag_len != SSL3_RT_MAX_PLAIN_LENGTH and KTLS are > ++ * mutually exclusive. Also note that with KTLS thisrr->length can > ++ * be > SSL3_RT_MAX_PLAIN_LENGTH (and rl->max_frag_len must be > ignored) > + */ > +- if (thisrr->length > rl->max_frag_len) { > ++ if (rl->max_frag_len != SSL3_RT_MAX_PLAIN_LENGTH > ++ && thisrr->length > rl->max_frag_len) { > + RLAYERfatal(rl, SSL_AD_RECORD_OVERFLOW, > SSL_R_DATA_LENGTH_TOO_LONG); > + goto end; > + } > diff --git a/patches/openssl-3.2.0/series b/patches/openssl-3.2.0/series > index d655cfc02..75c75e0cf 100644 > --- a/patches/openssl-3.2.0/series > +++ b/patches/openssl-3.2.0/series > @@ -5,4 +5,5 @@ > 0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch > 0004-conf-Serialize-allocation-free-of-ssl_names.patch > 0005-Configure-drop-fzero-call-used-regs-used-gpr-from-De.patch > -# c935d671c5de74f0dec935f1f45438cc - git-ptx-patches magic > +0006-Don-t-apply-max_frag_len-checking-if-no-Max-Fragment.patch > +# 224889bac59e4b20f72cdb177f2d29c8 - git-ptx-patches magic > > -- > 2.43.0 > > > -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
