Commit graph

2329 commits

Author SHA1 Message Date
Simon Butcher d9d0cda9fe Merge branch 'mbedtls-2.1' 2016-10-13 10:35:52 +01:00
Janos Follath 0be55a0549 Remove MBEDTLS_SSL_AEAD_RANDOM_IV feature
In a USENIX WOOT '16 paper the authors warn about a security risk
of random Initialisation Vectors (IV) repeating values.

The MBEDTLS_SSL_AEAD_RANDOM_IV feature is affected by this risk and
it isn't compliant with RFC5116. Furthermore, strictly speaking it
is a different cipher suite from the TLS (RFC5246) point of view.

Removing the MBEDTLS_SSL_AEAD_RANDOM_IV feature to resolve the above
problems.

Hanno Böck, Aaron Zauner, Sean Devlin, Juraj Somorovsky and Philipp
Jovanovic, "Nonce-Disrespecting Adversaries: Practical Forgery Attacks
on GCM in TLS", USENIX WOOT '16
2016-10-13 10:35:34 +01:00
Janos Follath 95b303648c Restore P>Q in RSA key generation (#558)
The PKCS#1 standard says nothing about the relation between P and Q
but many libraries guarantee P>Q and mbed TLS did so too in earlier
versions.

This commit restores this behaviour.
2016-10-13 00:58:09 +01:00
Andres AG 6c05208f96 Fix documentation for mbedtls_gcm_finish()
Fix implementation and documentation missmatch for the function
arguments to mbedtls_gcm_finish(). Also, removed redundant if condition
that always evaluates to true.
2016-10-12 19:54:07 +01:00
Andres AG fbd1cd9d57 Fix 1 byte overread in mbedtls_asn1_get_int() 2016-10-12 17:45:29 +01:00
Andres AG 8aa301ba31 Add missing bounds check in X509 DER write funcs
This patch adds checks in both mbedtls_x509write_crt_der and
mbedtls_x509write_csr_der before the signature is written to buf
using memcpy().
2016-10-11 16:52:06 +01:00
Janos Follath 433d4c84b3 Add safety check to sample mutex implementation
Due to inconsistent freeing strategy in pkparse.c the sample mutex
implementation in threading.c could lead to undefined behaviour by
destroying the same mutex several times.

This fix prevents mutexes from being destroyed several times in the
sample threading implementation.
2016-10-11 10:40:42 +01:00
Paul Bakker e6ed6a1fc4 Fix guards in SSL for ECDH key exchanges 2016-09-05 12:26:04 +03:00
Janos Follath 7b26865529 X509: Fix bug triggered by future CA among trusted
Fix an issue that caused valid certificates being rejected whenever an
expired or not yet valid version of the trusted certificate was before the
valid version in the trusted certificate list.
2016-07-14 13:19:46 +01:00
Simon Butcher 64f5df5545 Changed version number to version 2.1.5 2016-06-27 19:37:08 +01:00
Simon Butcher 88aa189415 Merge branch 'mbedtls-2.1' into mbedtls-2.1 2016-06-27 01:16:16 +01:00
Simon Butcher 60e2b2fe22 Fix whitespace and formatting in ssl_srv.c 2016-05-23 16:41:16 +01:00
Janos Follath 83f26052bf Fix non compliance SSLv3 in server extension handling.
The server code parses the client hello extensions even when the
protocol is SSLv3 and this behaviour is non compliant with rfc6101.
Also the server sends extensions in the server hello and omitting
them may prevent interoperability problems.
2016-05-23 14:50:15 +01:00
Janos Follath 25da9b35cf Moved underflow test to better reflect time constant behaviour. 2016-05-18 19:33:39 +01:00
Janos Follath 43e9297e12 Included test for integer underflow. 2016-05-18 19:30:09 +01:00
Janos Follath e33f559de1 Included tests for the overflow 2016-05-18 19:30:09 +01:00
Janos Follath e007c9fede Removing 'if' branch from the fix.
This new error shouldn't be distinguishable from other padding errors.
Updating 'bad' instead of adding a new 'if' branch.
2016-05-18 19:30:09 +01:00
Janos Follath a95834340a Length check added 2016-05-18 19:30:09 +01:00
SimonB 991244cd7b Fixes memory leak in memory_buffer_alloc.c debug
Debug symbols were being leaked in memory_buffer_alloc.c
2016-05-05 17:51:09 +01:00
Janos Follath e9d5510f05 Fix bug in ssl_write_supported_elliptic_curves_ext
Passing invalid curves to mbedtls_ssl_conf_curves potentially could caused a
crash later in ssl_write_supported_elliptic_curves_ext. #373
2016-04-22 09:55:32 +01:00
Janos Follath 689a627215 Fix null pointer dereference in the RSA module.
Introduced null pointer checks in mbedtls_rsa_rsaes_pkcs1_v15_encrypt
2016-04-19 10:20:59 +01:00
Simon Butcher 0705dd0588 Adds test for odd bit length RSA key size
Also tidy up ChangeLog following review.
2016-04-19 09:19:46 +01:00
Janos Follath 1a59a504e7 Fix odd bitlength RSA key generation
Fix issue that caused a hang up when generating RSA keys of odd
bitlength.
2016-04-19 09:19:21 +01:00
Janos Follath 16734f011b x509: trailing bytes in DER: fix bug
Fix bug in mbedtls_x509_crt_parse that caused trailing extra data in the
buffer after DER certificates to be included in the raw representation. #377
2016-03-15 23:47:36 +00:00
Manuel Pégourié-Gonnard bb81b4a009 Make ar invocation more portable
armar doesn't understand the syntax without dash. OTOH, the syntax with dash
is the only one specified by POSIX, and it's accepted by GNU ar, BSD ar (as
bundled with OS X) and armar, so it looks like the most portable syntax.

fixes #386
2016-01-08 14:52:14 +01:00
Janos Follath 79a1da6948 Improved on the previous fix and added a test case to cover both types
of carries.
2016-01-08 14:48:01 +01:00
Janos Follath a65477d885 Removed recursion from fix #309. 2016-01-08 14:48:00 +01:00
Janos Follath 5429c0a7d0 Improved on the fix of #309 and extended the test to cover subroutines. 2016-01-08 14:48:00 +01:00
Janos Follath d0e0c03520 Tests and fix added for #309 (inplace mpi doubling). 2016-01-08 14:47:16 +01:00
Simon Butcher 543e4366bc Change version number to 2.1.4
Changed version for library files and yotta module
2016-01-04 22:41:11 +00:00
Simon Butcher 6189175900 Fix for MPI divide on MSVC
Resolves multiple platform issues when building bignum.c with Microsoft
Visual Studio.
2016-01-03 20:32:46 +00:00
Simon Butcher 28b35c02f7 Merge branch 'mbedtls-2.1'
Merge of fix for memory leak in RSA-SSA signing - #372
2016-01-01 23:37:07 +00:00
Simon Butcher 318daf0c7e Fix for memory leak in RSA-SSA signing
Fix in mbedtls_rsa_rsassa_pkcs1_v15_sign() in rsa.c. Resolves github issue #372
2016-01-01 23:15:10 +00:00
Simon Butcher 976794a212 Merge remote-tracking branch 'origin/mbedtls-2.1' into HEAD 2015-12-31 23:42:54 +00:00
Simon Butcher 8360433788 Merge branch 'iotssl-541-2.1-pathlen-bugfix' 2015-12-31 23:21:52 +00:00
Simon Butcher c941b6cb31 Fix for unused variable warning 2015-12-28 01:29:10 +00:00
Simon Butcher 7ebe2781fe Fix for compiler warnings and style
Changes for C90 compliance, and style following review
2015-12-28 00:05:30 +00:00
Simon Butcher aa4114910a Merge 'iotssl-558-2.1-md5-tls-sigs-restricted' 2015-12-23 18:52:18 +00:00
Simon Butcher 35ea92dbc6 Merge 'iotssl-566-2.1-double-free-restricted'
Merge remote-tracking branch
'restricted/iotssl-566-2.1-double-free-restricted' into mbedtls-2.1
2015-12-23 16:49:46 +00:00
Simon Butcher e82ac57ef6 Merge remote-tracking branch 'origin/misc-2.1' into mbedtls-2.1 2015-12-22 19:36:17 +00:00
Simon Butcher e103aa8a53 Added description of change to the Changelog
Also clarified some comments following review.
2015-12-16 01:51:01 +00:00
Manuel Pégourié-Gonnard 9055c1a011 Fix wrong length limit in GCM
See for example page 8 of
http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf

The previous constant probably came from a typo as it was 2^26 - 2^5 instead
of 2^36 - 2^5. Clearly the intention was to allow for a constant bigger than
2^32 as the ull suffix and cast to uint64_t show.

fixes #362
2015-12-10 15:08:37 +01:00
Manuel Pégourié-Gonnard 7f890c3e96 Avoid seemingly-possible overflow
By looking just at that test, it looks like 2 + dn_size could overflow. In
fact that can't happen as that would mean we've read a CA cert of size is too
big to be represented by a size_t.

However, it's best for code to be more obviously free of overflow without
having to reason about the bigger picture.
2015-12-10 15:07:46 +01:00
Manuel Pégourié-Gonnard 3e60d2a458 Fix potential double free in cert writing code
In case an entry with the given OID already exists in the list passed to
mbedtls_asn1_store_named_data() and there is not enough memory to allocate
room for the new value, the existing entry will be freed but the preceding
entry in the list will sill hold a pointer to it. (And the following entries
in the list are no longer reachable.) This results in memory leak or a double
free.

The issue is we want to leave the list in a consistent state on allocation
failure. (We could add a warning that the list is left in inconsistent state
when the function returns NULL, but behaviour changes that require more care
from the user are undesirable, especially in a stable branch.)

The chosen solution is a bit inefficient in that there is a time where both
blocks are allocated, but at least it's safe and this should trump efficiency
here: this code is only used for generating certificates, which is unlikely to
be done on very constrained devices, or to be in the critical loop of
anything. Also, the sizes involved should be fairly small anyway.

fixes #367
2015-12-10 11:24:35 +01:00
Manuel Pégourié-Gonnard b6043f93b6 Fix levels of some debug messages
Messages about returning an error code that will be propagated all the way up
to the user should always be level 1.
2015-12-08 09:57:25 +01:00
Manuel Pégourié-Gonnard b39528e2e8 Disable MD5 in handshake signatures by default 2015-12-04 15:13:36 +01:00
Manuel Pégourié-Gonnard 013198f30f DTLS: avoid dropping too many records
When the peer retransmits a flight with many record in the same datagram, and
we already saw one of the records in that datagram, we used to drop the whole
datagram, resulting in interoperability failure (spurious handshake timeouts,
due to ignoring record retransmitted by the peer) with some implementations
(issues with Chrome were reported).

So in those cases, we want to only drop the current record, and look at the
following records (if any) in the same datagram. OTOH, this is not something
we always want to do, as sometime the header of the current record is not
reliable enough.

This commit introduces a new return code for ssl_parse_header() that allows to
distinguish if we should drop only the current record or the whole datagram,
and uses it in mbedtls_ssl_read_record()

fixes #345
2015-12-03 19:22:55 +01:00
Manuel Pégourié-Gonnard 5a8396ed55 Fix two more compiler warnings
- declaration after statement
- always true comparison due to limited range of operand
2015-12-03 19:09:23 +01:00
Manuel Pégourié-Gonnard 3eab29adc8 Fix potential integer overflow in prev. commit
Found by Clang's -Wshift-count-overflow
2015-12-03 19:09:21 +01:00
Simon Butcher ea303e3ece Added integer divide by as separate function
Added 64bit integer divided by 32bit integer, with remainder
2015-11-26 23:43:34 +00:00