On 2024-01-22 at 11:24 +01, Michael Olbrich <[email protected]> wrote:
On Mon, Jan 22, 2024 at 09:48:26AM +0100, Steffen Trumtrar wrote:
Signed-off-by: Steffen Trumtrar <[email protected]>
What's the upstream status of this patch?
The patch is in master. Should have added this to the description :(
Steffen
Michael
---
...-max_frag_len-checking-if-no-Max-Fragment.patch | 41 ++++++++++++++++++++++
patches/openssl-3.2.0/series | 3 +-
2 files changed, 43 insertions(+), 1 deletion(-)
diff --git
a/patches/openssl-3.2.0/0006-Don-t-apply-max_frag_len-checking-if-no-Max-Fragment.patch
b/patches/openssl-3.2.0/0006-Don-t-apply-max_frag_len-checking-if-no-Max-Fragment.patch
new file mode 100644
index 000000000..814bd07be
--- /dev/null
+++
b/patches/openssl-3.2.0/0006-Don-t-apply-max_frag_len-checking-if-no-Max-Fragment.patch
@@ -0,0 +1,41 @@
+From: Matt Caswell <[email protected]>
+Date: Tue, 2 Jan 2024 16:48:43 +0000
+Subject: [PATCH] Don't apply max_frag_len checking if no Max Fragment Length
+ extension
+
+Don't check the Max Fragment Length if the it hasn't been negotiated. We
+were checking it anyway, and using the default value
+(SSL3_RT_MAX_PLAIN_LENGTH). This works in most cases but KTLS can cause the
+record length to actually exceed this in some cases.
+
+Fixes #23169
+---
+ ssl/record/methods/tls_common.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/ssl/record/methods/tls_common.c b/ssl/record/methods/tls_common.c
+index 423777c18dd4..1a9320ae74de 100644
+--- a/ssl/record/methods/tls_common.c
++++ b/ssl/record/methods/tls_common.c
+@@ -910,11 +910,17 @@ int tls_get_more_records(OSSL_RECORD_LAYER *rl)
+ }
+
+ /*
+- * Check if the received packet overflows the current
+- * Max Fragment Length setting.
+- * Note: rl->max_frag_len > 0 and KTLS are mutually exclusive.
++ * Record overflow checking (e.g. checking if
++ * thisrr->length > SSL3_RT_MAX_PLAIN_LENGTH) is the responsibility of
++ * the post_process_record() function above. However we check here if
++ * the received packet overflows the current Max Fragment Length
setting
++ * if there is one.
++ * Note: rl->max_frag_len != SSL3_RT_MAX_PLAIN_LENGTH and KTLS are
++ * mutually exclusive. Also note that with KTLS thisrr->length can
++ * be > SSL3_RT_MAX_PLAIN_LENGTH (and rl->max_frag_len must be
ignored)
+ */
+- if (thisrr->length > rl->max_frag_len) {
++ if (rl->max_frag_len != SSL3_RT_MAX_PLAIN_LENGTH
++ && thisrr->length > rl->max_frag_len) {
+ RLAYERfatal(rl, SSL_AD_RECORD_OVERFLOW,
SSL_R_DATA_LENGTH_TOO_LONG);
+ goto end;
+ }
diff --git a/patches/openssl-3.2.0/series b/patches/openssl-3.2.0/series
index d655cfc02..75c75e0cf 100644
--- a/patches/openssl-3.2.0/series
+++ b/patches/openssl-3.2.0/series
@@ -5,4 +5,5 @@
0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch
0004-conf-Serialize-allocation-free-of-ssl_names.patch
0005-Configure-drop-fzero-call-used-regs-used-gpr-from-De.patch
-# c935d671c5de74f0dec935f1f45438cc - git-ptx-patches magic
+0006-Don-t-apply-max_frag_len-checking-if-no-Max-Fragment.patch
+# 224889bac59e4b20f72cdb177f2d29c8 - git-ptx-patches magic
--
2.43.0
--
Pengutronix e.K. | Dipl.-Inform. Steffen Trumtrar |
Steuerwalder Str. 21 | https://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686| Fax: +49-5121-206917-5555 |
