diff options
| author | Scott Larson <[email protected]> | 2020-07-13 13:31:50 -0700 |
|---|---|---|
| committer | Scott Larson <[email protected]> | 2020-07-13 13:31:50 -0700 |
| commit | b71efef0391ae1ed7837af0a2292a3b1f848aafb (patch) | |
| tree | 2b9720b2a4f13069c44967c84c7168ed5d0be459 | |
| parent | 101ae22d1e6e4d458aa6d400f4e419593dd4b7dd (diff) | |
updated to 6.0.1 and added additional processors/toolchainsv6.0.1_rel
108 files changed, 1791 insertions, 904 deletions
diff --git a/addons/dhcp/nxd_dhcp_client.c b/addons/dhcp/nxd_dhcp_client.c index 23ee2eba..861920cf 100644 --- a/addons/dhcp/nxd_dhcp_client.c +++ b/addons/dhcp/nxd_dhcp_client.c @@ -4298,7 +4298,7 @@ UINT status; /* FUNCTION RELEASE */ /* */ /* _nx_dhcp_interface_user_option_retrieve PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -4341,6 +4341,9 @@ UINT status; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* buffer length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_dhcp_interface_user_option_retrieve(NX_DHCP *dhcp_ptr, UINT iface_index, UINT option_request, UCHAR *destination_ptr, UINT *destination_size) @@ -4432,7 +4435,7 @@ NX_DHCP_INTERFACE_RECORD *interface_record = NX_NULL; long_ptr = (ULONG *) destination_ptr; /* Loop to set the long value. */ - for (i = 0; i < size;) + for (i = 0; i + 4 <= size;) { /* Set the long value. */ @@ -9157,7 +9160,7 @@ UINT status; /* FUNCTION RELEASE */ /* */ /* _nx_dhcp_client_interface_restore_record PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -9211,6 +9214,10 @@ UINT status; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* restored the gateway */ +/* address, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_dhcp_client_interface_restore_record(NX_DHCP *dhcp_ptr, UINT iface_index, NX_DHCP_CLIENT_RECORD *client_record_ptr, ULONG time_elapsed) @@ -9261,6 +9268,23 @@ NX_DHCP_INTERFACE_RECORD *interface_record = NX_NULL; return status; } + /* Check if the gateway address is valid. */ + if (interface_record -> nx_dhcp_gateway_address) + { + + /* Set the gateway address. */ + status = nx_ip_gateway_address_set(dhcp_ptr -> nx_dhcp_ip_ptr, interface_record -> nx_dhcp_gateway_address); + + /* Check status. */ + if (status != NX_SUCCESS) + { + + /* Release the DHCP mutex. */ + tx_mutex_put(&(dhcp_ptr -> nx_dhcp_mutex)); + return(status); + } + } + /* Now apply the time elapsed to update the DHCP Client time remaining on its lease and current DHCP state. */ status = _nx_dhcp_client_interface_update_time_remaining(dhcp_ptr, interface_record-> nx_dhcp_interface_index, time_elapsed); diff --git a/addons/dhcp/nxd_dhcp_server.c b/addons/dhcp/nxd_dhcp_server.c index 3190f209..ab73b137 100644 --- a/addons/dhcp/nxd_dhcp_server.c +++ b/addons/dhcp/nxd_dhcp_server.c @@ -55,7 +55,7 @@ static VOID _nx_dhcp_fast_periodic_timer_entry(ULONG info); static UINT _nx_dhcp_server_packet_process(NX_DHCP_SERVER *dhcp_ptr, NX_PACKET *packet_ptr); static UINT _nx_dhcp_respond_to_client_message(NX_DHCP_SERVER *dhcp_ptr, NX_DHCP_CLIENT *dhcp_client_ptr); static UINT _nx_dhcp_server_extract_information(NX_DHCP_SERVER *dhcp_ptr, NX_DHCP_CLIENT **dhcp_client_ptr, NX_PACKET *packet_ptr, UINT iface_index); -static UINT _nx_dhcp_process_option_data(NX_DHCP_CLIENT *dhcp_ptr, CHAR *buffer, ULONG value, UINT get_option_data, UINT size); +static UINT _nx_dhcp_process_option_data(NX_DHCP_CLIENT *dhcp_ptr, CHAR *buffer, UCHAR value, UINT get_option_data, UINT size); static UINT _nx_dhcp_add_option(UCHAR *bootp_message, UINT option, UINT size, ULONG value, UINT *index); static UINT _nx_dhcp_add_requested_option(NX_DHCP_SERVER *dhcp_ptr, UINT iface_index, UCHAR *buffer, UINT option, UINT *index); static UINT _nx_dhcp_set_server_options(NX_DHCP_SERVER *dhcp_ptr, CHAR *buffer, UINT buffer_length); @@ -4744,7 +4744,7 @@ UINT lease_time; /* FUNCTION RELEASE */ /* */ /* _nx_dhcp_server_extract_information PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -4792,6 +4792,10 @@ UINT lease_time; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* fixed the issue of read */ +/* and write overflow, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ static UINT _nx_dhcp_server_extract_information(NX_DHCP_SERVER *dhcp_ptr, NX_DHCP_CLIENT **dhcp_client_ptr, @@ -4975,7 +4979,7 @@ NX_DHCP_CLIENT *temp_client_rec_ptr; { /* Guard against a missing "END" marker by checking if we are at the end of the DHCP packet data. */ - if (work_ptr >= packet_ptr -> nx_packet_append_ptr) + if (work_ptr + 2 > packet_ptr -> nx_packet_append_ptr) { /* Yes, Client must have sent a DHCP message with improperly terminated option @@ -4995,30 +4999,27 @@ NX_DHCP_CLIENT *temp_client_rec_ptr; /* Move up the buffer pointer to the next option. */ work_ptr++; + /* Validate the size. */ + if (work_ptr + size > packet_ptr -> nx_packet_append_ptr) + { + return(NX_DHCP_IMPROPERLY_TERMINATED_OPTION); + } /* Is this the client ID option? */ if (value != NX_DHCP_SERVER_OPTION_CLIENT_ID) { - /* No, process as any other option. */ - _nx_dhcp_process_option_data(temp_client_rec_ptr, (CHAR *)work_ptr, value, NX_TRUE, size); - - /* Move up the buffer pointer past the current option data size to the next option. */ - work_ptr += size; - } - else - { + /* Check if there is enough space to store client requested options. */ + if (temp_client_rec_ptr -> nx_dhcp_client_option_count < NX_DHCP_CLIENT_OPTIONS_MAX) + { - work_ptr += size; + /* Process as any other option. */ + _nx_dhcp_process_option_data(temp_client_rec_ptr, (CHAR *)work_ptr, (UCHAR)value, NX_TRUE, size); + } } - /* Check that we haven't exceeded the limit on Client option requests. */ - if (temp_client_rec_ptr -> nx_dhcp_client_option_count >= NX_DHCP_CLIENT_OPTIONS_MAX) - { - - /* We have. This is all we have room to process. */ - break; - } + /* Move up the buffer pointer past the current option data size to the next option. */ + work_ptr += size; } } @@ -5034,7 +5035,7 @@ NX_DHCP_CLIENT *temp_client_rec_ptr; /* FUNCTION RELEASE */ /* */ /* _nx_dhcp_get_option_data PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -5067,24 +5068,25 @@ NX_DHCP_CLIENT *temp_client_rec_ptr; /* */ /* CALLED BY */ /* */ -/* _nx_dhcp_server_extract_information Extract DHCP data from packet */ +/* _nx_dhcp_server_extract_information Extract DHCP data from packet */ /* */ /* RELEASE HISTORY */ /* */ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* fixed the issue of infinite */ +/* recursion, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ -static UINT _nx_dhcp_process_option_data(NX_DHCP_CLIENT *dhcp_client_ptr, CHAR *buffer, ULONG option, UINT get_option_data, UINT size) +static UINT _nx_dhcp_process_option_data(NX_DHCP_CLIENT *dhcp_client_ptr, CHAR *buffer, UCHAR option, UINT get_option_data, UINT size) { -CHAR *temp_ptr; UINT status; ULONG option_value = 0; - - /* Do we parse option data for this option? */ if (get_option_data) { @@ -5173,7 +5175,7 @@ ULONG option_value = 0; case 53: /* Message type */ - dhcp_client_ptr -> nx_dhcp_user_options[dhcp_client_ptr -> nx_dhcp_client_option_count] = (UCHAR)option; + dhcp_client_ptr -> nx_dhcp_user_options[dhcp_client_ptr -> nx_dhcp_client_option_count] = option; dhcp_client_ptr -> nx_dhcp_message_type = (UCHAR)option_value; dhcp_client_ptr -> nx_dhcp_client_option_count++; break; @@ -5192,25 +5194,16 @@ ULONG option_value = 0; break; case 55: - /* Option parameter list */ - temp_ptr = buffer ; - /* Call this function to handle options within the option 55. */ - while (size) + /* Check if there is enough space to store all the client requested options. */ + if (dhcp_client_ptr -> nx_dhcp_client_option_count + size > NX_DHCP_CLIENT_OPTIONS_MAX) { - - /* Get the next option in the Option parameter list. */ - _nx_dhcp_server_get_data((UCHAR *)temp_ptr, 1, &option); - - /* Update the client record with that option. */ - _nx_dhcp_process_option_data(dhcp_client_ptr, temp_ptr, option, NX_FALSE, 1); - - /* Move down the buffer containing the option parameter list data. */ - temp_ptr++; - - /* Update the amount of option data left for option 55. */ - size--; + size = NX_DHCP_CLIENT_OPTIONS_MAX - dhcp_client_ptr -> nx_dhcp_client_option_count; } + + /* Update the client record with that option. */ + memcpy(&(dhcp_client_ptr -> nx_dhcp_user_options[dhcp_client_ptr -> nx_dhcp_client_option_count]), buffer, size); + dhcp_client_ptr -> nx_dhcp_client_option_count += size; break; case 61: diff --git a/addons/dhcp/nxd_dhcp_server.h b/addons/dhcp/nxd_dhcp_server.h index bb91b67f..3874d686 100644 --- a/addons/dhcp/nxd_dhcp_server.h +++ b/addons/dhcp/nxd_dhcp_server.h @@ -23,10 +23,10 @@ /**************************************************************************/ /* */ -/* APPLICATION INTERFACE DEFINITION RELEASE */ +/* APPLICATION INTERFACE DEFINITION RELEASE */ /* */ /* nxd_dhcp_server.h PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -43,6 +43,10 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* modified the type of */ +/* nx_dhcp_user_options, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ @@ -444,7 +448,7 @@ typedef struct NX_DHCP_CLIENT_STRUCT UINT nx_dhcp_client_hwtype; /* Client interface hardware type e.g. Ethernet. */ ULONG nx_dhcp_broadcast_flag_set; /* Parse broadcast flags from DHCP messages. */ UINT nx_dhcp_client_option_count; /* Number of user options in client request */ - UINT nx_dhcp_user_options[NX_DHCP_CLIENT_OPTIONS_MAX]; + UCHAR nx_dhcp_user_options[NX_DHCP_CLIENT_OPTIONS_MAX]; ULONG nx_dhcp_session_timeout; /* Time out on waiting for client's next response */ UINT nx_dhcp_response_type_to_client; /* DHCP code for response to send back to client. */ diff --git a/addons/dhcp/nxd_dhcpv6_client.c b/addons/dhcp/nxd_dhcpv6_client.c index 3f689710..911eaab8 100644 --- a/addons/dhcp/nxd_dhcpv6_client.c +++ b/addons/dhcp/nxd_dhcpv6_client.c @@ -4423,7 +4423,7 @@ UCHAR original_state; /* FUNCTION RELEASE */ /* */ /* _nx_dhcpv6_process_client_duid PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -4436,8 +4436,8 @@ UCHAR original_state; /* INPUT */ /* */ /* dhcpv6_ptr Pointer to DHCPV6 Client instance */ -/* received_buffer Pointer to server reply */ -/* length Size of server reply buffer */ +/* option_data Pointer to option data */ +/* option_length Size of option data */ /* */ /* OUTPUT */ /* */ @@ -4458,23 +4458,29 @@ UCHAR original_state; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* packet length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ -UINT _nx_dhcpv6_process_client_duid(NX_DHCPV6 *dhcpv6_ptr, UCHAR *received_buffer, UINT length) +UINT _nx_dhcpv6_process_client_duid(NX_DHCPV6 *dhcpv6_ptr, UCHAR *option_data, UINT option_length) { ULONG data; -UINT index; +UINT index = 0; - /* Set an index past the option code and data length. */ - index = 4; - /* The Client should already have its own DUID on record. So just parse the data and compare each DUID field with the Client's DUID. */ + /* Check option length for DUID type and hardware type. */ + if (option_length < 4) + { + return(NX_DHCPV6_INVALID_CLIENT_DUID); + } + /* Extract the DUID type which should be the next 2 bytes. */ - _nx_dhcpv6_utility_get_data((received_buffer + index), 2, &data); + _nx_dhcpv6_utility_get_data((option_data + index), 2, &data); /* Does this match the Client DUID type on record? */ if (data != (dhcpv6_ptr -> nx_dhcpv6_client_duid.nx_duid_type)) @@ -4487,7 +4493,7 @@ UINT index; index += 2; /* Extract the hardware type which should be the next 2 bytes. */ - _nx_dhcpv6_utility_get_data((received_buffer + index), 2, &data); + _nx_dhcpv6_utility_get_data((option_data + index), 2, &data); /* Does this match the Client DUID hardware type on record? */ if (data != (dhcpv6_ptr -> nx_dhcpv6_client_duid.nx_hardware_type)) @@ -4502,9 +4508,15 @@ UINT index; /* IS this a link layer plus time DUID type? */ if ((dhcpv6_ptr -> nx_dhcpv6_client_duid.nx_duid_type) == NX_DHCPV6_DUID_TYPE_LINK_TIME) { - + + /* Check option length for time. */ + if (index + 4 > option_length) + { + return(NX_DHCPV6_INVALID_CLIENT_DUID); + } + /* Yes; Extract the time which should be the next 4 bytes. */ - _nx_dhcpv6_utility_get_data((received_buffer + index), 4, &data); + _nx_dhcpv6_utility_get_data((option_data + index), 4, &data); /* Does this match the Client DUID time on record? */ if (data != (dhcpv6_ptr -> nx_dhcpv6_client_duid.nx_duid_time)) @@ -4522,9 +4534,15 @@ UINT index; { /* The length of link layer address is 48 bits. */ + + /* Check option length for 48 bits mac address. */ + if (index + 6 > option_length) + { + return(NX_DHCPV6_INVALID_CLIENT_DUID); + } /* Yes; Extract the link local address msw which should be the next 2 bytes. */ - _nx_dhcpv6_utility_get_data((received_buffer + index), 2, &data); + _nx_dhcpv6_utility_get_data((option_data + index), 2, &data); index += 2; } else if (dhcpv6_ptr -> nx_dhcpv6_client_duid.nx_hardware_type == NX_DHCPV6_CLIENT_HARDWARE_TYPE_EUI_64) @@ -4532,8 +4550,14 @@ UINT index; /* The length of link layer address is 64 bits. */ + /* Check option length for 64 bits mac address. */ + if (index + 8 > option_length) + { + return(NX_DHCPV6_INVALID_CLIENT_DUID); + } + /* Yes; Extract the link local address msw which should be the next 4 bytes. */ - _nx_dhcpv6_utility_get_data((received_buffer + index), 4, &data); + _nx_dhcpv6_utility_get_data((option_data + index), 4, &data); index += 4; } @@ -4546,7 +4570,7 @@ UINT index; } /* Yes; Extract the link local address lsw which should be the next 4 bytes. */ - _nx_dhcpv6_utility_get_data((received_buffer + index), 4, &data); + _nx_dhcpv6_utility_get_data((option_data + index), 4, &data); index += 4; /* Does this match the Client DUID link layer least significant bytes on record? */ @@ -4557,9 +4581,8 @@ UINT index; return NX_DHCPV6_INVALID_CLIENT_DUID; } - /* Are we past the end of the buffer, subtracting for the toplevel opcode and - length of the IANA option? */ - if (((index - 4) > length) || ((index - 4) < length)) + /* Are we past the end of the buffer. */ + if (index != option_length) { /* Yes, return the error status to reject this packet. */ @@ -4575,7 +4598,7 @@ UINT index; /* FUNCTION RELEASE */ /* */ /* _nx_dhcpv6_process_domain_name PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -4589,8 +4612,9 @@ UINT index; /* INPUT */ /* */ /* dhcpv6_ptr Pointer to DHCPV6 Client instance */ -/* buffer_ptr Pointer to request packet buffer */ -/* length Location into buffer to read data */ +/* packet_start Pointer to packet buffer */ +/* option_data Pointer to option data */ +/* option_length Size of option data */ /* */ /* OUTPUT */ /* */ @@ -4611,9 +4635,12 @@ UINT index; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* packet length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ -UINT _nx_dhcpv6_process_domain_name(NX_DHCPV6 *dhcpv6_ptr, UCHAR *packet_start, UCHAR *received_buffer, UINT length) +UINT _nx_dhcpv6_process_domain_name(NX_DHCPV6 *dhcpv6_ptr, UCHAR *packet_start, UCHAR *option_data, UINT option_length) { UINT domain_name_length; @@ -4627,18 +4654,18 @@ UINT i; /* Initialize the value. */ domain_name_length = 0; temp_length = 0; - domain_name_ptr = received_buffer + 4; + domain_name_ptr = option_data; buffer_prepend_ptr = &dhcpv6_ptr -> nx_dhcpv6_domain_name[0]; buffer_size = NX_DHCPV6_DOMAIN_NAME_BUFFER_SIZE; /* Process the domain search list options. */ - while(temp_length < length) + while(temp_length < option_length) { /* Calculate the domain name length in the Domaim Search List option,include the null flag '\0'. */ - for (i = 0; (i + temp_length < length) && (domain_name_ptr[i] != '\0'); i++); + for (i = 0; (i + temp_length < option_length) && (domain_name_ptr[i] != '\0'); i++); - if (i + temp_length == length) + if (i + temp_length == option_length) { return(NX_DHCPV6_PROCESSING_ERROR); } @@ -4647,6 +4674,12 @@ UINT i; temp_length += (i + 1); } + /* Check buffer size. */ + if (buffer_size < 1) + { + return(NX_DHCPV6_PROCESSING_ERROR); + } + /* Record the real domain name and return the length, one less for NULL termination. */ domain_name_length = _nx_dhcpv6_name_string_unencode(packet_start, (UINT)(domain_name_ptr - packet_start), buffer_prepend_ptr, (UINT)((buffer_size - 1) & 0xFFFFFFFF)); @@ -4886,7 +4919,7 @@ UINT length = 0; /* FUNCTION RELEASE */ /* */ /* _nx_dhcpv6_process_DNS_server PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -4900,8 +4933,8 @@ UINT length = 0; /* INPUT */ /* */ /* dhcpv6_ptr Pointer to DHCPV6 Client instance */ -/* buffer_ptr Pointer to request packet buffer */ -/* length Location into buffer to read data*/ +/* option_data Pointer to option data */ +/* option_length Size of option data */ /* */ /* OUTPUT */ /* */ @@ -4924,54 +4957,57 @@ UINT length = 0; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* packet length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ -UINT _nx_dhcpv6_process_DNS_server(NX_DHCPV6 *dhcpv6_ptr, UCHAR *received_buffer, UINT length) +UINT _nx_dhcpv6_process_DNS_server(NX_DHCPV6 *dhcpv6_ptr, UCHAR *option_data, UINT option_length) { -UINT index; -UINT w, j; - +UINT index = 0; +UINT w, j = 0; - /* Set the location of the read pointer into the buffer. */ - index = 4; - j = 0; /* Loop through the length of the buffer to parse. */ - while ((index - 4) < length) + while ((index + 16) <= option_length) { - /* Set the IP version. */ - dhcpv6_ptr -> nx_dhcpv6_DNS_name_server_address[j].nxd_ip_version = NX_IP_VERSION_V6; - - /* Get the next IPv6 DNS server address. */ - for (w = 0; w <= 3; w++) + /* Is the DHCPv6 Client configured to store another DNS server address? */ + if (j < NX_DHCPV6_NUM_DNS_SERVERS) { - /* Is the DHCPv6 Client configured to store another DNS server address? */ - if (j < NX_DHCPV6_NUM_DNS_SERVERS) + /* Set the IP version. */ + dhcpv6_ptr -> nx_dhcpv6_DNS_name_server_address[j].nxd_ip_version = NX_IP_VERSION_V6; + + /* Get the next IPv6 DNS server address. */ + for (w = 0; w <= 3; w++) { /* Yes; copy the next word into the current DNS server address. */ memcpy(&(dhcpv6_ptr -> nx_dhcpv6_DNS_name_server_address[j].nxd_ip_address.v6[w]), - (received_buffer + index), sizeof(ULONG)); + (option_data + index), sizeof(ULONG)); /* Adjust for endianness. */ NX_CHANGE_ULONG_ENDIAN(dhcpv6_ptr -> nx_dhcpv6_DNS_name_server_address[j].nxd_ip_address.v6[w]); + + /* Move to the next IPv6 address word. */ + index += 4; } - /* Move to the next IPv6 address word. */ - index += 4; + /* Get the next DNS server address in the reply buffer. */ + j++; } + else + { - dhcpv6_ptr -> nx_dhcpv6_DNS_name_server_address[j].nxd_ip_version = NX_IP_VERSION_V6; - - /* Get the next DNS server address in the reply buffer. */ - j++; + /* Move to the next IPv6 address. */ + index += 16; + } } /* Is there any more data in the buffer? */ - if (((index - 4 ) > length) || ((index - 4 )< length)) + if (index != option_length) { /* Yes, not sure what is going on with this packet. Treat as an error. */ @@ -4987,7 +5023,7 @@ UINT w, j; /* FUNCTION RELEASE */ /* */ /* _nx_dhcpv6_process_ia PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -5002,8 +5038,8 @@ UINT w, j; /* INPUT */ /* */ /* dhcpv6_ptr Pointer to DHCPV6 Client instance */ -/* buffer_ptr Pointer to request packet buffer */ -/* length Size of server reply buffer */ +/* option_data Pointer to option data */ +/* option_length Size of option data */ /* ia_index The index of IA address */ /* */ /* OUTPUT */ @@ -5032,57 +5068,58 @@ UINT w, j; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* packet length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ -UINT _nx_dhcpv6_process_ia(NX_DHCPV6 *dhcpv6_ptr, UCHAR *received_buffer, UINT length, UINT ia_index) +UINT _nx_dhcpv6_process_ia(NX_DHCPV6 *dhcpv6_ptr, UCHAR *option_data, UINT option_length, UINT ia_index) { ULONG preferred_lifetime; ULONG valid_lifetime; -UINT index, w; +UINT index = 0, w; UINT status; -ULONG opcode, option_length; +ULONG ia_option_code, ia_option_length; /* Fill in the IA address code and length. Client might already have one on record, but use the server's data instead. */ - dhcpv6_ptr -> nx_dhcpv6_ia[ia_index].nx_op_code = NX_DHCPV6_OP_IA_ADDRESS; + dhcpv6_ptr -> nx_dhcpv6_ia[ia_index].nx_op_code = (USHORT)NX_DHCPV6_OP_IA_ADDRESS; + dhcpv6_ptr -> nx_dhcpv6_ia[ia_index].nx_option_length = (USHORT)option_length; - /* Set the index for the read pointer past the option header. */ - index = 4; + /* Check option length for Ipv6 address (16 bytes), preferred-lifetime (4 bytes) and valid-lifetime (4 bytes). */ + if (option_length < 24) + { + return(NX_DHCPV6_INVALID_IA_DATA); + } + /* Process IPv6 address. */ for (w = 0; w <= 3; w++) { /* Copy each IPv6 address word into the IA address. */ memcpy(&(dhcpv6_ptr -> nx_dhcpv6_ia[ia_index].nx_global_address.nxd_ip_address.v6[w]), - (received_buffer + index), sizeof(ULONG)); + (option_data + index), sizeof(ULONG)); /* Adjust for endianness. */ NX_CHANGE_ULONG_ENDIAN(dhcpv6_ptr -> nx_dhcpv6_ia[ia_index].nx_global_address.nxd_ip_address.v6[w]); /* Move to the next IPv6 address word. */ index += 4; - - /* Check if we're going past the end of the option data. */ - if ((index - 4) > length) - { - /* Yes, return an error status.*/ - return NX_DHCPV6_INVALID_IA_DATA; - } } dhcpv6_ptr -> nx_dhcpv6_ia[ia_index].nx_global_address.nxd_ip_version = NX_IP_VERSION_V6; /* Copy the lifetime data from the reply buffer to temporary variables.*/ - memcpy(&preferred_lifetime, (received_buffer + index), sizeof(ULONG)); - index += (ULONG)sizeof(ULONG); + memcpy(&preferred_lifetime, (option_data + index), sizeof(ULONG)); + index += 4; /* Adjust for endianness. */ NX_CHANGE_ULONG_ENDIAN(preferred_lifetime); - memcpy(&valid_lifetime, (received_buffer + index), sizeof(ULONG)); - index += (ULONG)sizeof(ULONG); + memcpy(&valid_lifetime, (option_data + index), sizeof(ULONG)); + index += 4; /* Adjust for endianness. */ NX_CHANGE_ULONG_ENDIAN(valid_lifetime); @@ -5110,15 +5147,21 @@ ULONG opcode, option_length; dhcpv6_ptr -> nx_dhcpv6_ia[ia_index].nx_address_map = 0xFFFFFFFF; /* Check if we're at the end of option data yet. */ - if (index - 4 == length) + if (index == option_length) { /* Yes, all done. */ return NX_SUCCESS; } + /* Check option length for status code option. */ + if (index + 4 > option_length) + { + return(NX_DHCPV6_INVALID_IA_DATA); + } + /* Process the status code option. */ - status = _nx_dhcpv6_utility_get_block_option_length(received_buffer + index, &opcode, &option_length); + status = _nx_dhcpv6_utility_get_block_option_length(option_data + index, &ia_option_code, &ia_option_length); /* Check that the block data is valid. */ if (status != NX_SUCCESS) @@ -5128,13 +5171,22 @@ ULONG opcode, option_length; return status; } + /* Skip status option code and length. */ + index += 4; + + /* This is a double check to verify we haven't gone off the end of the packet buffer. */ + if (index + ia_option_length > option_length) + { + return (NX_DHCPV6_INVALID_IA_DATA); + } + /* Check if this is an IAaddr status option request. */ - if (opcode == NX_DHCPV6_OP_STATUS_CODE) + if (ia_option_code == NX_DHCPV6_OP_STATUS_CODE) { /* The IAaddr option returned by the DHCPv6 server includes a status option. */ /* Process the status. */ - status = _nx_dhcpv6_process_status(dhcpv6_ptr, (received_buffer + index), option_length); + status = _nx_dhcpv6_process_status(dhcpv6_ptr, (option_data + index), ia_option_length); /* Now check on the server status of the previous option in the DHCP message. */ if ((status == NX_SUCCESS) && (dhcpv6_ptr -> nx_status_code != NX_DHCPV6_SUCCESS)) @@ -5165,10 +5217,10 @@ ULONG opcode, option_length; } /* Keep track of how far into the packet we have parsed. */ - index += option_length + 4; + index += ia_option_length; /* Check if we went past the reported size of IA address data. */ - if ((index - 4) != length) + if (index != option_length) { /* Return an error status. Cannot accept this reply. */ @@ -5184,7 +5236,7 @@ ULONG opcode, option_length; /* FUNCTION RELEASE */ /* */ /* _nx_dhcpv6_process_iana PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -5200,8 +5252,8 @@ ULONG opcode, option_length; /* INPUT */ /* */ /* dhcpv6_ptr Pointer to DHCPV6 Client instance */ -/* received_buffer Pointer to server reply */ -/* length Size of server reply buffer */ +/* option_data Pointer to option data */ +/* option_length Size of option data */ /* */ /* OUTPUT */ /* */ @@ -5231,25 +5283,31 @@ ULONG opcode, option_length; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* packet length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ -UINT _nx_dhcpv6_process_iana(NX_DHCPV6 *dhcpv6_ptr, UCHAR *received_buffer, UINT length) +UINT _nx_dhcpv6_process_iana(NX_DHCPV6 *dhcpv6_ptr, UCHAR *option_data, UINT option_length) { UINT status; ULONG T1, T2, data; -UINT index; -ULONG opcode, option_length; +UINT index = 0; +ULONG iana_option_code, iana_option_length; UINT ia_index; UINT ia_count = 0; UINT ia_status; - - /* Set up the location of the read pointer past option header. */ - index = 4; - /* The first word should contain the IANA option code and its option data length. */ - memcpy(&data, (received_buffer + index), sizeof(ULONG)); + /* Check option length for IANA ID. */ + if (option_length < 4) + { + return(NX_DHCPV6_INVALID_IANA_DATA); + } + + /* Get the IANA ID. */ + memcpy(&data, (option_data + index), 4); /* Adjust for endianness. */ NX_CHANGE_ULONG_ENDIAN(data); @@ -5266,15 +5324,21 @@ UINT ia_status; /* Update the write location index. */ index += 4; + /* Check option length for T1 and T2. */ + if (index + 8 > option_length) + { + return(NX_DHCPV6_INVALID_IANA_DATA); + } + /* Copy T1 and T2 from the buffer into temporary variables. */ - memcpy(&T1, (received_buffer + index), sizeof(ULONG)); - index += (ULONG)sizeof(ULONG); + memcpy(&T1, (option_data + index), 4); + index += 4; /* Adjust for endianness. */ NX_CHANGE_ULONG_ENDIAN(T1); - memcpy(&T2, (received_buffer + index), sizeof(ULONG)); - index += (ULONG)sizeof(ULONG); + memcpy(&T2, (option_data + index), 4); + index += 4; /* Adjust for endianness. */ NX_CHANGE_ULONG_ENDIAN(T2); @@ -5304,7 +5368,7 @@ UINT ia_status; } /* Check if we're at the end of option data yet. */ - if (index == length) + if (index == option_length) { /* Yes, all done. */ @@ -5330,11 +5394,11 @@ UINT ia_status; } /* Now we recurse into the options embedded in the IANA option. */ - do + while (index + 4 <= option_length) { /* Get the next option code and length. */ - status = _nx_dhcpv6_utility_get_block_option_length((received_buffer + index), &opcode, &option_length); + status = _nx_dhcpv6_utility_get_block_option_length((option_data + index), &iana_option_code, &iana_option_length); /* Check that the block data is valid. */ if (status != NX_SUCCESS) @@ -5344,8 +5408,17 @@ UINT ia_status; return status; } + /* Skip IANA sub option code and length. */ + index += 4; + + /* This is a double check to verify we haven't gone off the end of the packet buffer. */ + if (index + iana_option_length > option_length) + { + return (NX_DHCPV6_INVALID_IANA_DATA); + } + /* Check if this is an IA address option request. */ - if (opcode == NX_DHCPV6_OP_IA_ADDRESS) + if (iana_option_code == NX_DHCPV6_OP_IA_ADDRESS) { /* Set the ia count to record the IA option of reply message. */ @@ -5361,7 +5434,7 @@ UINT ia_status; { /* Yes, find it, update the IA option. */ - status = _nx_dhcpv6_process_ia(dhcpv6_ptr, (received_buffer + index), option_length, ia_index); + status = _nx_dhcpv6_process_ia(dhcpv6_ptr, (option_data + index), iana_option_length, ia_index); /* Check the process status. */ if (status != NX_SUCCESS) @@ -5391,7 +5464,7 @@ UINT ia_status; { /* Yes, it is available, update the IA option. */ - status = _nx_dhcpv6_process_ia(dhcpv6_ptr, (received_buffer + index), option_length, ia_index); + status = _nx_dhcpv6_process_ia(dhcpv6_ptr, (option_data + index), iana_option_length, ia_index); /* Check the process status. */ if (status != NX_SUCCESS) @@ -5405,15 +5478,15 @@ UINT ia_status; } } } - } - + } + /* Check if this is an IAaddr status option request. */ - if (opcode == NX_DHCPV6_OP_STATUS_CODE) + if (iana_option_code == NX_DHCPV6_OP_STATUS_CODE) { /* The IAaddr option returned by the DHCPv6 server includes a status option. */ /* Process the status. */ - status = _nx_dhcpv6_process_status(dhcpv6_ptr, (received_buffer + index), option_length); + status = _nx_dhcpv6_process_status(dhcpv6_ptr, (option_data + index), iana_option_length); /* Now check on the server status of the previous option in the DHCP message. */ if ((status == NX_SUCCESS) && (dhcpv6_ptr -> nx_status_code != NX_DHCPV6_SUCCESS)) @@ -5439,9 +5512,8 @@ UINT ia_status; } /* Keep track of how far into the packet we have parsed. */ - index += option_length + 4; - - } while ((index - 4) < length); + index += iana_option_length; + } return NX_SUCCESS; } @@ -5452,7 +5524,7 @@ UINT ia_status; /* FUNCTION RELEASE */ /* */ /* _nx_dhcpv6_process_preference PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -5466,8 +5538,8 @@ UINT ia_status; /* INPUT */ /* */ /* dhcpv6_ptr Pointer to DHCPV6 Client instance */ -/* buffer_ptr Pointer to request packet buffer */ -/* length Location into buffer to read data */ +/* option_data Pointer to option data */ +/* option_length Size of option data */ /* */ /* OUTPUT */ /* */ @@ -5489,43 +5561,28 @@ UINT ia_status; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* packet length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ -UINT _nx_dhcpv6_process_preference(NX_DHCPV6 *dhcpv6_ptr, UCHAR *received_buffer, UINT length) +UINT _nx_dhcpv6_process_preference(NX_DHCPV6 *dhcpv6_ptr, UCHAR *option_data, UINT option_length) { -UINT index; -USHORT temp; - /* Fill in the option code and length. */ dhcpv6_ptr -> nx_dhcpv6_preference.nx_op_code = NX_DHCPV6_OP_PREFERENCE; - dhcpv6_ptr -> nx_dhcpv6_preference.nx_option_length = (USHORT)length; + dhcpv6_ptr -> nx_dhcpv6_preference.nx_option_length = (USHORT)option_length; - /* Set the location of the read pointer into the buffer. */ - index = 4; - - /* set local variable for convenience. */ - temp = *(received_buffer + index); - - /* Get the server preference field, and apply to the DHCPv6 Client. */ - dhcpv6_ptr -> nx_dhcpv6_preference.nx_pref_value = temp; - - - /* Adjust for endianness. */ - NX_CHANGE_USHORT_ENDIAN(dhcpv6_ptr -> nx_dhcpv6_preference.nx_pref_value); - - /* Update the pointer past the data we just extracted. */ - index++; - - /* Is there any more data in this option? */ - if (((index - 4) > length) || ((index - 4) < length)) + /* Check option length for preference value. */ + if (option_length != 1) { - - /* Yes, but there shouldn't be. Return as an error status. */ - return NX_DHCPV6_INVALID_PREF_DATA; + return(NX_DHCPV6_INVALID_PREF_DATA); } + /* Get the server preference field, and apply to the DHCPv6 Client. */ + dhcpv6_ptr -> nx_dhcpv6_preference.nx_pref_value = (USHORT)(*option_data); + return NX_SUCCESS; } @@ -5535,7 +5592,7 @@ USHORT temp; /* FUNCTION RELEASE */ /* */ /* _nx_dhcpv6_process_server_duid PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -5549,8 +5606,8 @@ USHORT temp; /* INPUT */ /* */ /* dhcpv6_ptr Pointer to DHCPV6 Client instance */ -/* received_buffer Pointer to server reply */ -/* length Size of server reply buffer */ +/* option_data Pointer to option data */ +/* option_length Size of option data */ /* */ /* OUTPUT */ /* */ @@ -5571,12 +5628,15 @@ USHORT temp; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* packet length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ -UINT _nx_dhcpv6_process_server_duid(NX_DHCPV6 *dhcpv6_ptr, UCHAR *received_buffer, UINT length) +UINT _nx_dhcpv6_process_server_duid(NX_DHCPV6 *dhcpv6_ptr, UCHAR *option_data, UINT option_length) { -UINT index; +UINT index = 0; ULONG temp_type; ULONG temp_hardware_type; ULONG temp_time = 0; @@ -5586,19 +5646,22 @@ ULONG temp_lsw = 0; /* Set the DHCPv6 option header fields for a Server DUID. */ dhcpv6_ptr -> nx_dhcpv6_server_duid.nx_op_code = NX_DHCPV6_OP_SERVER_ID; - dhcpv6_ptr -> nx_dhcpv6_server_duid.nx_option_length = (USHORT)length; + dhcpv6_ptr -> nx_dhcpv6_server_duid.nx_option_length = (USHORT)option_length; - /* Set the index past the option code and length. */ - index = 4; + /* Check option length for DUID type and hardware type. */ + if (option_length < 4) + { + return(NX_DHCPV6_INVALID_SERVER_DUID); + } /* Extract the DUID type which should be the next 2 bytes. */ - _nx_dhcpv6_utility_get_data((received_buffer + index), 2, &temp_type); + _nx_dhcpv6_utility_get_data((option_data + index), 2, &temp_type); /* Update the index for moving the buffer pointer forward. */ index += 2; /* Extract the hardware type which should be the next 2 bytes. */ - _nx_dhcpv6_utility_get_data((received_buffer + index), 2, &temp_hardware_type); + _nx_dhcpv6_utility_get_data((option_data + index), 2, &temp_hardware_type); /* Update the index for moving the buffer pointer forward. */ index += 2; @@ -5606,9 +5669,15 @@ ULONG temp_lsw = 0; /* Is this a link layer plus time DUID type? */ if (temp_type == NX_DHCPV6_DUID_TYPE_LINK_TIME) { - + + /* Check option length for time. */ + if (index + 4 > option_length) + { + return(NX_DHCPV6_INVALID_SERVER_DUID); + } + /* Yes; Extract the time which should be the next 4 bytes. */ - _nx_dhcpv6_utility_get_data((received_buffer + index), 4, &temp_time); + _nx_dhcpv6_utility_get_data((option_data + index), 4, &temp_time); /* Update the index for moving the buffer pointer forward. */ index += 4; @@ -5620,8 +5689,14 @@ ULONG temp_lsw = 0; /* The length of link layer address is 48 bits. */ + /* Check option length for 48 bits mac address. */ + if (index + 6 > option_length) + { + return(NX_DHCPV6_INVALID_SERVER_DUID); + } + /* Yes; Extract the link local address msw which should be the next 2 bytes. */ - _nx_dhcpv6_utility_get_data((received_buffer + index), 2, &temp_msw); + _nx_dhcpv6_utility_get_data((option_data + index), 2, &temp_msw); /* Update the index for moving the buffer pointer forward. */ index += 2; @@ -5631,22 +5706,27 @@ ULONG temp_lsw = 0; /* The length of link layer address is 64 bits. */ + /* Check option length for 64 bits mac address. */ + if (index + 8 > option_length) + { + return(NX_DHCPV6_INVALID_SERVER_DUID); + } + /* Yes; Extract the link local address msw which should be the next 4 bytes. */ - _nx_dhcpv6_utility_get_data((received_buffer + index), 4, &temp_msw); + _nx_dhcpv6_utility_get_data((option_data + index), 4, &temp_msw); /* Update the index for moving the buffer pointer forward. */ index += 4; } /* Yes; Extract the link local address lsw which should be the next 4 bytes. */ - _nx_dhcpv6_utility_get_data((received_buffer + index), 4, &temp_lsw); + _nx_dhcpv6_utility_get_data((option_data + index), 4, &temp_lsw); /* Update the index for moving the buffer pointer forward. */ index += 4; - /* Check if we are past the end of the buffer, subtracting for the toplevel opcode and - length of the IANA option. */ - if (((index - 4) > length) || ((index - 4) < length)) + /* Check if we are past the end of the buffer. */ + if (index != option_length) { /* Yes, return the error status to reject the packet. */ @@ -5699,7 +5779,7 @@ ULONG temp_lsw = 0; /* FUNCTION RELEASE */ /* */ /* _nx_dhcpv6_process_status PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -5713,8 +5793,8 @@ ULONG temp_lsw = 0; /* INPUT */ /* */ /* dhcpv6_ptr Pointer to DHCPV6 Client instance */ -/* buffer_ptr Pointer to request packet buffer */ -/* length Location into buffer to read data*/ +/* option_data Pointer to option data */ +/* option_length Size of option data */ /* */ /* OUTPUT */ /* */ @@ -5735,30 +5815,36 @@ ULONG temp_lsw = 0; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* packet length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ -UINT _nx_dhcpv6_process_status(NX_DHCPV6 *dhcpv6_ptr, UCHAR *received_buffer, UINT length) +UINT _nx_dhcpv6_process_status(NX_DHCPV6 *dhcpv6_ptr, UCHAR *option_data, UINT option_length) { -UINT index; +UINT index = 0; UINT message_length; ULONG status_code; - - /* Set the location for the buffer read pointer. */ - index = 4; + + /* Check option length for status code. */ + if (option_length < 2) + { + return(NX_DHCPV6_INVALID_OPTION_DATA); + } /* Get the status field itself. */ - _nx_dhcpv6_utility_get_data((received_buffer + index), sizeof(USHORT), &status_code); - + _nx_dhcpv6_utility_get_data((option_data + index), sizeof(USHORT), &status_code); + /* Update the index for moving the buffer pointer forward. */ - index += (ULONG)sizeof(USHORT); - + index += 2; + /* Set the status code. */ dhcpv6_ptr -> nx_status_code = (USHORT)status_code; /* Now figure out how much of the message we can save, if not all of it. */ - if ((length - sizeof(USHORT)) > NX_DHCPV6_MAX_MESSAGE_SIZE) + if ((option_length - 2) > NX_DHCPV6_MAX_MESSAGE_SIZE) { /* Store up to this much, message is truncated but possibly still useful. */ @@ -5768,11 +5854,11 @@ ULONG status_code; { /* Store all of it. */ - message_length = length - (ULONG)sizeof(USHORT); + message_length = option_length - 2; } /* Copy the status into the Client record. */ - memcpy(dhcpv6_ptr -> nx_status_message, (received_buffer + index), message_length); + memcpy(dhcpv6_ptr -> nx_status_message, (option_data + index), message_length); return NX_SUCCESS; } @@ -5783,7 +5869,7 @@ ULONG status_code; /* FUNCTION RELEASE */ /* */ /* _nx_dhcpv6_process_time_zone PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -5797,8 +5883,8 @@ ULONG status_code; /* INPUT */ /* */ /* dhcpv6_ptr Pointer to DHCPV6 Client instance */ -/* buffer_ptr Pointer to request packet buffer */ -/* length Location into buffer to read data */ +/* option_data Pointer to option data */ +/* option_length Size of option data */ /* */ /* OUTPUT */ /* */ @@ -5819,39 +5905,30 @@ ULONG status_code; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* packet length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ -UINT _nx_dhcpv6_process_time_zone(NX_DHCPV6 *dhcpv6_ptr, UCHAR *received_buffer, UINT length) +UINT _nx_dhcpv6_process_time_zone(NX_DHCPV6 *dhcpv6_ptr, UCHAR *option_data, UINT option_length) { UINT i; -UINT index; - /* Set the location of the read pointer into the buffer. */ - index = 4; - /* Make sure the time zone fits in the client buffer. */ - if (length > NX_DHCPV6_TIME_ZONE_BUFFER_SIZE) + if (option_length > NX_DHCPV6_TIME_ZONE_BUFFER_SIZE) { /* It doesn't. Fit what we can. */ - length = NX_DHCPV6_TIME_ZONE_BUFFER_SIZE; + option_length = NX_DHCPV6_TIME_ZONE_BUFFER_SIZE; } /* Copy the time zone from the buffer to the Client record. */ - for (i = 0; i < length; i++) + for (i = 0; i < option_length; i++) { - dhcpv6_ptr -> nx_dhcpv6_time_zone[i] = *(received_buffer + 4 + i); - } - - /* Is there any more data in this option? */ - if (((index - 4 + i) > length) || ((index - 4 + i) < length)) - { - - /* Yes, treat as in improperly formatted packet. */ - return NX_DHCPV6_INVALID_OPTION_DATA; + dhcpv6_ptr -> nx_dhcpv6_time_zone[i] = *(option_data + i); } /* Return completion status. */ @@ -5864,7 +5941,7 @@ UINT index; /* FUNCTION RELEASE */ /* */ /* _nx_dhcpv6_process_time_server PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -5878,8 +5955,8 @@ UINT index; /* INPUT */ /* */ /* dhcpv6_ptr Pointer to DHCPV6 Client instance */ -/* buffer_ptr Pointer to request packet buffer */ -/* length Location into buffer to read data*/ +/* option_data Pointer to option data */ +/* option_length Size of option data */ /* */ /* OUTPUT */ /* */ @@ -5900,55 +5977,58 @@ UINT index; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* packet length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ -UINT _nx_dhcpv6_process_time_server(NX_DHCPV6 *dhcpv6_ptr, UCHAR *received_buffer, UINT length) +UINT _nx_dhcpv6_process_time_server(NX_DHCPV6 *dhcpv6_ptr, UCHAR *option_data, UINT option_length) { -UINT index; -UINT w, j; - +UINT index = 0; +UINT w, j = 0; - /* Set the location of the read pointer into the buffer. */ - index = 4; - j = 0; /* Loop through the length of the buffer to parse. */ - while ((index - 4) < length) + while (index + 16 <= option_length) { - /* Set the IP version. */ - dhcpv6_ptr -> nx_dhcpv6_time_server_address[j].nxd_ip_version = NX_IP_VERSION_V6; - - /* Get the next IPv6 time server address. */ - for (w = 0; w <= 3; w++) + /* Check that the DHCPv6 Client configured to store this time server address e.g. it may + only store one address, but the server could be sending two or more. */ + if (j < NX_DHCPV6_NUM_TIME_SERVERS) { - /* Check that the DHCPv6 Client configured to store this time server address e.g. it may - only store one address, but the server could be sending two or more. */ - if (j < NX_DHCPV6_NUM_TIME_SERVERS) + /* Set the IP version. */ + dhcpv6_ptr -> nx_dhcpv6_time_server_address[j].nxd_ip_version = NX_IP_VERSION_V6; + + /* Get the next IPv6 time server address. */ + for (w = 0; w <= 3; w++) { /* Yes; copy each IPv6 address word into the time server address. */ memcpy(&(dhcpv6_ptr -> nx_dhcpv6_time_server_address[j].nxd_ip_address.v6[w]), - (received_buffer + index), sizeof(ULONG)); + (option_data + index), sizeof(ULONG)); /* Adjust for endianness. */ NX_CHANGE_ULONG_ENDIAN(dhcpv6_ptr -> nx_dhcpv6_time_server_address[j].nxd_ip_address.v6[w]); + + /* Move to the next IPv6 address word. */ + index += 4; } - /* Move to the next IPv6 address word. */ - index += 4; + /* Start parsing the next time server address, if there is one. */ + j++; } + else + { - dhcpv6_ptr -> nx_dhcpv6_time_server_address[j].nxd_ip_version = NX_IP_VERSION_V6; - - /* Start parsing the next time server address, if there is one*/ - j++; + /* Move to the next timer server address. */ + index += 16; + } } /* Is there any more data in this option? */ - if (((index - 4) > length) || ((index - 4) < length)) + if (index != option_length) { /* Yes, treat as in improperly formatted packet. */ @@ -10801,7 +10881,7 @@ UINT ia_count = 0; dhcpv6_option_ptr = (packet_ptr -> nx_packet_prepend_ptr + 4); /* Initialize local variables. */ - index = 0; + index = 4; dhcpv6_ptr -> nx_dhcpv6_reply_option_flags = 0; dhcpv6_ptr -> nx_dhcpv6_reply_option_current_pref_value = 0; @@ -10814,7 +10894,7 @@ UINT ia_count = 0; /* Now parse all the DHCPv6 option blocks in the packet buffer. */ /* 4 bytes is data pointer offset, and 4 bytes for option code and option length. */ - while (index <= (packet_ptr -> nx_packet_length - 4 - 4)) + while (index + 4 <= packet_ptr -> nx_packet_length) { /* Get the option code and length of data of the current option block. */ @@ -10855,18 +10935,24 @@ UINT ia_count = 0; break; } case NX_DHCPV6_OP_IA_NA: - { - + { + + /* The minimum length of IANA option field is 12 bytes. */ + if (option_length < 12) + { + return(NX_DHCPV6_INCOMPLETE_OPTION_BLOCK); + } + /* Yes, The message includes the Server DUID option. */ dhcpv6_ptr -> nx_dhcpv6_reply_option_flags |= NX_DHCPV6_INCLUDE_IA_NA_OPTION; - /* Skip the IA_NA header data. */ - dhcpv6_iana_option_ptr = dhcpv6_option_ptr + 16; + /* Skip the IA_NA header data (4 bytes for IANA option code and option length, 12 bytes for IANA option field). */ + dhcpv6_iana_option_ptr = dhcpv6_option_ptr + 4 + 12; iana_index = 0; /* Process the IA and status options embedded in the IANA option. */ - /* 12 bytes is IA_NA header, 4 bytes for iana option code and option length. */ - while(iana_index <= (option_length - 12 - 4)) + /* 12 bytes is IA_NA header, 4 bytes for iana sub option code and option length. */ + while(iana_index + 4 <= (option_length - 12)) { /* Get the next option code and length. */ @@ -11084,24 +11170,30 @@ UINT ia_count = 0; case NX_DHCPV6_OP_PREFERENCE: { - USHORT temp; + + /* The preference option length must be 1 byte. */ + if (option_length != 1) + { + return(NX_DHCPV6_INCOMPLETE_OPTION_BLOCK); + } /* Yes, The message includes the preference option. */ dhcpv6_ptr -> nx_dhcpv6_reply_option_flags |= NX_DHCPV6_INCLUDE_PREFERENCE_OPTION; - /* Set the pointer. */ - temp = *(dhcpv6_option_ptr + 4); - /* Record the preference option value of current advetise message. */ - dhcpv6_ptr -> nx_dhcpv6_reply_option_current_pref_value = temp; - - /* Adjust the endianness. */ - NX_CHANGE_USHORT_ENDIAN(dhcpv6_ptr -> nx_dhcpv6_reply_option_current_pref_value); + dhcpv6_ptr -> nx_dhcpv6_reply_option_current_pref_value = (USHORT)(*(dhcpv6_option_ptr + 4)); + break; } case NX_DHCPV6_OP_STATUS_CODE: - { + { + + /* The minimum length of status option is 2 bytes. */ + if (option_length < 2) + { + return(NX_DHCPV6_INCOMPLETE_OPTION_BLOCK); + } /* Yes, the message includes the STATUS option, get the code. */ memcpy(&status_code, (dhcpv6_option_ptr + 4), sizeof(USHORT)); @@ -11399,7 +11491,7 @@ ULONG returned_xid; /* FUNCTION RELEASE */ /* */ /* _nx_dhcpv6_extract_packet_information PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -11451,13 +11543,16 @@ ULONG returned_xid; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* packet length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_dhcpv6_extract_packet_information(NX_DHCPV6 *dhcpv6_ptr, NX_PACKET *packet_ptr) { UINT status; -ULONG op_code; +ULONG option_code; ULONG option_length; UCHAR *buffer_ptr; UINT index; @@ -11466,15 +11561,15 @@ UINT index; /* Set a pointer to the options of DHCPv6. */ buffer_ptr = packet_ptr -> nx_packet_prepend_ptr + 4; - /* Initialize local variables. */ - index = 0; + /* Update index to the options. */ + index = 4; /* Now parse all the DHCPv6 option blocks in the packet buffer. */ - while (index < (packet_ptr -> nx_packet_length - 4)) + while (index + 4 <= packet_ptr -> nx_packet_length) { /* Get the option code and length of data of the current option block. */ - status = _nx_dhcpv6_utility_get_block_option_length(buffer_ptr, &op_code, &option_length); + status = _nx_dhcpv6_utility_get_block_option_length(buffer_ptr, &option_code, &option_length); /* Check that the block data is valid. */ if (status != NX_SUCCESS) @@ -11484,14 +11579,27 @@ UINT index; return status; } + /* Keep track of how far into the packet we have parsed. */ + index += option_length + 4; + + /* This is a double check to verify we haven't gone off the end of the packet buffer. */ + if (index > packet_ptr -> nx_packet_length) + { + return(NX_DHCPV6_INVALID_DATA_SIZE); + } + + /* Update buffer pointer to option data. */ + buffer_ptr += 4; + /* Process the option code with an option specific API. */ - switch (op_code) + switch (option_code) { + /* Note - these 'process' functions will not move the buffer pointer. */ case NX_DHCPV6_OP_CLIENT_ID: { - + /* Process the Client DUID. */ status = _nx_dhcpv6_process_client_duid(dhcpv6_ptr, buffer_ptr, option_length); @@ -11499,16 +11607,16 @@ UINT index; } case NX_DHCPV6_OP_SERVER_ID: - { - + { + /* Process the Server DUID. */ status = _nx_dhcpv6_process_server_duid(dhcpv6_ptr, buffer_ptr, option_length); - + break; } case NX_DHCPV6_OP_IA_NA: { - + status = _nx_dhcpv6_process_iana(dhcpv6_ptr, buffer_ptr, option_length); /* Note: this API directly handles any server error codes received. */ @@ -11519,10 +11627,10 @@ UINT index; /* This should not happen. The IA address option must be embedded in the IANA option. */ case NX_DHCPV6_OP_IA_ADDRESS: { - + /* Don't process an IA address option outside of an address association (IANA). */ status = NX_DHCPV6_MISSING_IANA_OPTION; - + break; } @@ -11552,7 +11660,7 @@ UINT index; /* Process the preference option. */ case NX_DHCPV6_OP_PREFERENCE: { - + status = _nx_dhcpv6_process_preference(dhcpv6_ptr, buffer_ptr, option_length); break; } @@ -11562,7 +11670,7 @@ UINT index; case NX_DHCPV6_OP_DNS_SERVER: { - + status = _nx_dhcpv6_process_DNS_server(dhcpv6_ptr, buffer_ptr, option_length); break; @@ -11601,17 +11709,13 @@ UINT index; } /* Move to the next top level option. */ - buffer_ptr += option_length + 4; - - /* Keep track of how far into the packet we have parsed. */ - index += option_length + 4; - + buffer_ptr += option_length; } /* Now, the index should be the packet length. */ - if(index != (packet_ptr -> nx_packet_length - 4)) + if(index != packet_ptr -> nx_packet_length) { - return NX_DHCPV6_INVALID_DATA_SIZE; + return(NX_DHCPV6_INVALID_DATA_SIZE); } /* Yes, the packet data processing is completed. */ diff --git a/addons/dhcp/nxd_dhcpv6_client.h b/addons/dhcp/nxd_dhcpv6_client.h index 8b2a1663..2ff5c029 100644 --- a/addons/dhcp/nxd_dhcpv6_client.h +++ b/addons/dhcp/nxd_dhcpv6_client.h @@ -26,7 +26,7 @@ /* APPLICATION INTERFACE DEFINITION RELEASE */ /* */ /* nxd_dhcpv6_client.h PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -43,6 +43,9 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* packet length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ @@ -1025,16 +1028,16 @@ UINT _nx_dhcpv6_scan_packet_options(NX_DHCPV6 *dhcpv6_ptr, NX_PACKET *pac UINT _nx_dhcpv6_preprocess_packet_information(NX_DHCPV6 *dhcpv6_ptr, NX_PACKET *packet_ptr); UINT _nx_dhcpv6_extract_packet_information(NX_DHCPV6 *dhcpv6_ptr, NX_PACKET *packet_ptr); VOID _nx_dhcpv6_flush_queue_packets(NX_DHCPV6 *dhcpv6_ptr); -UINT _nx_dhcpv6_process_client_duid(NX_DHCPV6 *dhcpv6_ptr, UCHAR *received_buffer, UINT length); -UINT _nx_dhcpv6_process_DNS_server(NX_DHCPV6 *dhcpv6_ptr, UCHAR *received_buffer, UINT length); -UINT _nx_dhcpv6_process_domain_name(NX_DHCPV6 *dhcpv6_ptr, UCHAR *packet_start, UCHAR *received_buffer, UINT length); -UINT _nx_dhcpv6_process_ia(NX_DHCPV6 *dhcpv6_ptr, UCHAR *received_buffer, UINT length, UINT ia_index); -UINT _nx_dhcpv6_process_iana(NX_DHCPV6 *dhcpv6_ptr, UCHAR *received_buffer, UINT length); -UINT _nx_dhcpv6_process_preference(NX_DHCPV6 *dhcpv6_ptr, UCHAR *received_buffer, UINT length); -UINT _nx_dhcpv6_process_server_duid(NX_DHCPV6 *dhcpv6_ptr, UCHAR *received_buffer, UINT length); -UINT _nx_dhcpv6_process_status(NX_DHCPV6 *dhcpv6_ptr, UCHAR *received_buffer, UINT length); -UINT _nx_dhcpv6_process_time_zone(NX_DHCPV6 *dhcpv6_ptr, UCHAR *received_buffer, UINT length); -UINT _nx_dhcpv6_process_time_server(NX_DHCPV6 *dhcpv6_ptr, UCHAR *received_buffer, UINT length); +UINT _nx_dhcpv6_process_client_duid(NX_DHCPV6 *dhcpv6_ptr, UCHAR *option_data, UINT option_length); +UINT _nx_dhcpv6_process_DNS_server(NX_DHCPV6 *dhcpv6_ptr, UCHAR *option_data, UINT option_length); +UINT _nx_dhcpv6_process_domain_name(NX_DHCPV6 *dhcpv6_ptr, UCHAR *packet_start, UCHAR *option_data, UINT option_length); +UINT _nx_dhcpv6_process_ia(NX_DHCPV6 *dhcpv6_ptr, UCHAR *option_data, UINT option_length, UINT ia_index); +UINT _nx_dhcpv6_process_iana(NX_DHCPV6 *dhcpv6_ptr, UCHAR *option_data, UINT option_length); +UINT _nx_dhcpv6_process_preference(NX_DHCPV6 *dhcpv6_ptr, UCHAR *option_data, UINT option_length); +UINT _nx_dhcpv6_process_server_duid(NX_DHCPV6 *dhcpv6_ptr, UCHAR *option_data, UINT option_length); +UINT _nx_dhcpv6_process_status(NX_DHCPV6 *dhcpv6_ptr, UCHAR *option_data, UINT option_length); +UINT _nx_dhcpv6_process_time_zone(NX_DHCPV6 *dhcpv6_ptr, UCHAR *option_data, UINT option_length); +UINT _nx_dhcpv6_process_time_server(NX_DHCPV6 *dhcpv6_ptr, UCHAR *option_data, UINT option_length); VOID _nx_dhcpv6_IP_lifetime_timeout_entry(ULONG dhcpv6_ptr_value); VOID _nx_dhcpv6_session_timeout_entry(ULONG dhcpv6_ptr_value); UINT _nx_dhcpv6_utility_get_block_option_length(UCHAR *buffer_ptr, ULONG *option, ULONG *length); diff --git a/addons/dhcp/nxd_dhcpv6_server.c b/addons/dhcp/nxd_dhcpv6_server.c index 49fc0be7..5a0c9db2 100644 --- a/addons/dhcp/nxd_dhcpv6_server.c +++ b/addons/dhcp/nxd_dhcpv6_server.c @@ -882,7 +882,7 @@ UINT status; /* FUNCTION RELEASE */ /* */ /* _nx_dhcpv6_retrieve_client_record PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -938,6 +938,9 @@ UINT status; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), corrected*/ +/* the length of identifier, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_dhcpv6_retrieve_client_record(NX_DHCPV6_SERVER *dhcpv6_server_ptr, UINT table_index, ULONG *message_xid, NXD_ADDRESS *client_address, UINT *client_state, @@ -1025,13 +1028,13 @@ INT length; } *duid_vendor_number = client_ptr -> nx_dhcpv6_client_duid.nx_duid_enterprise_number; - length = client_ptr -> nx_dhcpv6_client_duid.nx_option_length - 4; + length = client_ptr -> nx_dhcpv6_client_duid.nx_option_length - 6; if (length < 0) { - return NX_DHCPV6_INVALID_DUID; } + /* NOTE: The size of duid vendor private must be equal to or greater than NX_DHCPV6_SERVER_DUID_VENDOR_ASSIGNED_LENGTH. */ memcpy(duid_vendor_private, &(client_ptr -> nx_dhcpv6_client_duid.nx_duid_private_identifier[0]), (UINT)length); *duid_private_length = (UINT)length; } @@ -3730,7 +3733,7 @@ NXD_ADDRESS client_address; /* FUNCTION RELEASE */ /* */ /* _nx_dhcpv6_server_extract_packet_information PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -3740,7 +3743,7 @@ NXD_ADDRESS client_address; /* This function extracts data from DHCPv6 Client request packets. A */ /* request is checked for valid message type and required DHCPv6 data. */ /* A client record is created if one does not exist for the client and */ -/* the data updated into it. */ +/* the data updated into it. */ /* */ /* INPUT */ /* */ @@ -3777,6 +3780,9 @@ NXD_ADDRESS client_address; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* packet length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_dhcpv6_server_extract_packet_information(NX_DHCPV6_SERVER *dhcpv6_server_ptr, NX_DHCPV6_CLIENT **dhcpv6_client_ptr, NX_PACKET *packet_ptr, @@ -3786,7 +3792,7 @@ UINT _nx_dhcpv6_server_extract_packet_information(NX_DHCPV6_SERVER *dhcpv6_serv UINT status; UINT add_on; UINT record_index; -ULONG op_code; +ULONG option_code; ULONG option_length; UCHAR *buffer_ptr; UINT index; @@ -3811,6 +3817,14 @@ UINT matching; /* Assume the Client is not bound to an IP address yet. */ temp_client_rec.nx_dhcpv6_state = NX_DHCPV6_STATE_UNBOUND; + /* Check packet for message type and transaction ID. */ + if (packet_ptr -> nx_packet_length < 4) + { + + /* Reported length of the packet may be incorrect. */ + return NX_DHCPV6_PROCESSING_ERROR; + } + /* Set a pointer to the start of DHCPv6 data. */ buffer_ptr = packet_ptr -> nx_packet_prepend_ptr; @@ -3855,19 +3869,30 @@ UINT matching; buffer_ptr += 3; + /* Update index for message type and transaction ID. */ + index += 4; + /* Now parse all the DHCPv6 option blocks in the packet buffer. */ - /* 4 bytes is data pointer offset, and 4 bytes for option code and option length. */ - while (index <= packet_ptr -> nx_packet_length - 4 - 4) + /* 4 bytes for option code and option length. */ + while (index + 4 <= packet_ptr -> nx_packet_length) { /* Get the option code and length of data of the current option block. */ - status = _nx_dhcpv6_server_utility_get_block_option_length(buffer_ptr, &op_code, &option_length); + status = _nx_dhcpv6_server_utility_get_block_option_length(buffer_ptr, &option_code, &option_length); + + /* Check that the block data is valid. */ + if (status != NX_SUCCESS) + { + + /* No, return the error status. */ + return status; + } /* Keep track of how far into the packet we have parsed. */ index += option_length + 4; /* This is a double check to verify we haven't gone off the end of the packet buffer. */ - if (index > packet_ptr -> nx_packet_length - 4) + if (index > packet_ptr -> nx_packet_length) { /* Reported length of the packet may be incorrect. At any rate, we don't know @@ -3875,25 +3900,21 @@ UINT matching; return NX_DHCPV6_PROCESSING_ERROR; } - /* Check that the block data is valid. */ - if (status != NX_SUCCESS) - { - - /* No, return the error status. */ - return status; - } + /* Update buffer pointer to option data. */ + buffer_ptr += 4; /* Process the option code with an option specific API. */ - switch (op_code) + switch (option_code) { + /* Note - these 'process' functions will not move the buffer pointer. */ - + case NX_DHCPV6_OP_DUID_CLIENT: - client_duid.nx_op_code = (USHORT)op_code; + client_duid.nx_op_code = (USHORT)option_code; client_duid.nx_option_length = (USHORT)option_length; - status = _nx_dhcpv6_process_duid(&client_duid, NX_DHCPV6_CLIENT_DUID_TYPE, buffer_ptr, option_length); + status = _nx_dhcpv6_process_duid(&client_duid, option_code, option_length, buffer_ptr); if (status != NX_SUCCESS) { @@ -3911,10 +3932,10 @@ UINT matching; case NX_DHCPV6_OP_DUID_SERVER: - server_duid.nx_op_code = (USHORT)op_code; + server_duid.nx_op_code = (USHORT)option_code; server_duid.nx_option_length = (USHORT)option_length; - status = _nx_dhcpv6_process_duid(&server_duid, NX_DHCPV6_SERVER_DUID_TYPE, buffer_ptr, option_length); + status = _nx_dhcpv6_process_duid(&server_duid, option_code, option_length, buffer_ptr); if (status != NX_SUCCESS) { @@ -3933,7 +3954,7 @@ UINT matching; case NX_DHCPV6_OP_IA_NA: - status = _nx_dhcpv6_server_process_iana(&temp_client_rec, buffer_ptr, option_length); + status = _nx_dhcpv6_server_process_iana(&temp_client_rec, option_code, option_length, buffer_ptr); if (status != NX_SUCCESS) { @@ -3954,7 +3975,7 @@ UINT matching; /* Option request option contains request usually for network configuration parameters such as the DNS server. */ - status = _nx_dhcpv6_process_option_request(&temp_client_rec, buffer_ptr, option_length); + status = _nx_dhcpv6_process_option_request(&temp_client_rec, option_code, option_length, buffer_ptr); if (status != NX_SUCCESS) { @@ -3967,7 +3988,7 @@ UINT matching; case NX_DHCPV6_OP_ELAPSED_TIME: /* The elapsed time is time elapsed since the client initiated the IP lease request. */ - status = _nx_dhcpv6_process_elapsed_time(&temp_client_rec, buffer_ptr, option_length); + status = _nx_dhcpv6_process_elapsed_time(&temp_client_rec, option_code, option_length, buffer_ptr); if (status != NX_SUCCESS) { @@ -3991,14 +4012,13 @@ UINT matching; } /* Move to the next top level option. */ - buffer_ptr += option_length + 4; - - } + buffer_ptr += option_length; + } /* Check for an improperly formatted packet. */ - if (index != packet_ptr -> nx_packet_length - 4) + if (index != packet_ptr -> nx_packet_length) { - + /* If we get here if we are not at the expected end of the buffer. Oops */ return NX_DHCPV6_PROCESSING_ERROR; } @@ -6023,7 +6043,7 @@ UINT _nx_dhcpv6_update_client_record(NX_DHCPV6_SERVER *dhcpv6_server_ptr, /* FUNCTION RELEASE */ /* */ /* _nx_dhcpv6_server_process_iana PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -6035,8 +6055,9 @@ UINT _nx_dhcpv6_update_client_record(NX_DHCPV6_SERVER *dhcpv6_server_ptr, /* INPUT */ /* */ /* dhcpv6_client_ptr Pointer to DHCPV6 Client instance */ -/* received_buffer Pointer to client packet buffer */ -/* length Size of client packet buffer */ +/* option_code Option code */ +/* option_length Size of option data */ +/* option_data Pointer to option data */ /* */ /* OUTPUT */ /* */ @@ -6060,15 +6081,18 @@ UINT _nx_dhcpv6_update_client_record(NX_DHCPV6_SERVER *dhcpv6_server_ptr, /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* packet length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ -UINT _nx_dhcpv6_server_process_iana(NX_DHCPV6_CLIENT *dhcpv6_client_ptr, UCHAR *received_buffer, UINT length) +UINT _nx_dhcpv6_server_process_iana(NX_DHCPV6_CLIENT *dhcpv6_client_ptr, ULONG option_code, UINT option_length, UCHAR *option_data) { UINT status; ULONG data; UINT index; -ULONG opcode, option_length; +ULONG iana_option_code, iana_option_length; UINT process_ia_option; @@ -6076,35 +6100,39 @@ UINT process_ia_option; process_ia_option = NX_TRUE; index = 0; - _nx_dhcpv6_server_utility_get_data(received_buffer + index, sizeof(USHORT), &data); - dhcpv6_client_ptr -> nx_dhcpv6_iana.nx_op_code = (USHORT)data; - - index = 2; - _nx_dhcpv6_server_utility_get_data(received_buffer + index, sizeof(USHORT), &data); - dhcpv6_client_ptr -> nx_dhcpv6_iana.nx_option_length = (USHORT)data; + /* Set option code and length. */ + dhcpv6_client_ptr -> nx_dhcpv6_iana.nx_op_code = (USHORT)option_code; + dhcpv6_client_ptr -> nx_dhcpv6_iana.nx_option_length = (USHORT)option_length; - /* Set up the location of the read pointer past option header. */ - index = 4; + /* Check option length for IANA ID. */ + if (option_length < 4) + { + return(NX_DHCPV6_INVALID_IANA_DATA); + } /* The first word should contain the IANA ID. */ - _nx_dhcpv6_server_utility_get_data(received_buffer + index, sizeof(ULONG), &data); - + _nx_dhcpv6_server_utility_get_data(option_data + index, sizeof(ULONG), &data); + /* Process the IANA ID. */ dhcpv6_client_ptr -> nx_dhcpv6_iana.nx_IA_NA_id = data; /* Update the write location index. */ index += 4; + /* Check option length for T1 and T2. */ + if (index + 8 > option_length) + { + return(NX_DHCPV6_INVALID_IANA_DATA); + } + /* Copy T1 and T2 from the buffer into IANA. */ - _nx_dhcpv6_server_utility_get_data(received_buffer + index, sizeof(ULONG), &data); + _nx_dhcpv6_server_utility_get_data(option_data + index, sizeof(ULONG), &data); dhcpv6_client_ptr -> nx_dhcpv6_iana.nx_T1 = data; - - index += (ULONG)sizeof(ULONG); - - _nx_dhcpv6_server_utility_get_data(received_buffer + index, sizeof(ULONG), &data); index += (ULONG)sizeof(ULONG); + _nx_dhcpv6_server_utility_get_data(option_data + index, sizeof(ULONG), &data); dhcpv6_client_ptr -> nx_dhcpv6_iana.nx_T2 = data; + index += (ULONG)sizeof(ULONG); /* Check for invalid T1/T2 lifetimes. */ if (dhcpv6_client_ptr -> nx_dhcpv6_iana.nx_T1 > dhcpv6_client_ptr -> nx_dhcpv6_iana.nx_T2) @@ -6115,7 +6143,7 @@ UINT process_ia_option; } /* Check if we're at the end of option data yet. */ - if ((index - 4) == length) + if (index == option_length) { /* Yes, all done. */ @@ -6124,11 +6152,11 @@ UINT process_ia_option; /* Now we recurse into the options embedded in the IANA option. We do it here because this is part of the IANA option data length. */ - do + while (index + 4 <= option_length) { /* Get the next option code and length. */ - status = _nx_dhcpv6_server_utility_get_block_option_length(received_buffer + index, &opcode, &option_length); + status = _nx_dhcpv6_server_utility_get_block_option_length(option_data + index, &iana_option_code, &iana_option_length); /* Check that the block data is valid. */ if (status != NX_SUCCESS) @@ -6138,14 +6166,23 @@ UINT process_ia_option; return status; } + /* Skip IA option code and length. */ + index += 4; + + /* This is a double check to verify we haven't gone off the end of the packet buffer. */ + if (index + iana_option_length > option_length) + { + return (NX_DHCPV6_INVALID_IANA_DATA); + } + /* Check if this is an IA address option request, and if we have already processed an IA in this message (the DHCPv6 server is limited to one IA per client message). */ - if (opcode == NX_DHCPV6_OP_IA_ADDRESS) + if (iana_option_code == NX_DHCPV6_OP_IA_ADDRESS) { /* Yes it is, so process it. */ - status = _nx_dhcpv6_server_process_ia(dhcpv6_client_ptr, (received_buffer + index), option_length, process_ia_option); + status = _nx_dhcpv6_server_process_ia(dhcpv6_client_ptr, iana_option_code, iana_option_length, (option_data + index), process_ia_option); /* Check for errors processing the DHCPv6 message. */ if (status != NX_SUCCESS) @@ -6157,16 +6194,14 @@ UINT process_ia_option; /* Indicate we already have an IA option if the client request contains multiple IAs. */ process_ia_option = NX_FALSE; - - /* Keep track of how far into the packet we have parsed. */ - index += option_length + 4; } - - } while (index - 4 < length); + /* Keep track of how far into the packet we have parsed. */ + index += iana_option_length; + } /* Check if we went past the reported size of IA-NA data. */ - if (index - 4 > length) + if (index != option_length) { /* Yes return an error status. */ @@ -6182,7 +6217,7 @@ UINT process_ia_option; /* FUNCTION RELEASE */ /* */ /* _nx_dhcpv6_process_option_request PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -6194,8 +6229,9 @@ UINT process_ia_option; /* INPUT */ /* */ /* dhcpv6_client_ptr Pointer to DHCPV6 client instance */ -/* received_buffer Pointer to packet buffer */ -/* length Size of packet buffer */ +/* option_code Option code */ +/* option_length Size of option data */ +/* option_data Pointer to option data */ /* */ /* OUTPUT */ /* */ @@ -6216,53 +6252,35 @@ UINT process_ia_option; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* packet length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ -UINT _nx_dhcpv6_process_option_request(NX_DHCPV6_CLIENT *dhcpv6_client_ptr, UCHAR *received_buffer, UINT length) +UINT _nx_dhcpv6_process_option_request(NX_DHCPV6_CLIENT *dhcpv6_client_ptr, ULONG option_code, UINT option_length, UCHAR *option_data) { ULONG data; -UINT i; -UINT index; -UINT option_length; - - NX_PARAMETER_NOT_USED(length); +UINT i = 0; +UINT index = 0; - index = 0; - - /* Extract the option code which should be the next 2 bytes. */ - _nx_dhcpv6_server_utility_get_data(received_buffer + index, 2, &data); - - dhcpv6_client_ptr -> nx_dhcpv6_option_request.nx_op_code = (USHORT)data; - - index += 2; - /* Extract the option length which should be the next 2 bytes. */ - _nx_dhcpv6_server_utility_get_data(received_buffer + index, 2, &data); - dhcpv6_client_ptr -> nx_dhcpv6_option_request.nx_option_length = (USHORT)data; - - index += 2; - - option_length = dhcpv6_client_ptr -> nx_dhcpv6_option_request.nx_option_length; - - i = 0; + /* Set option code and length. */ + dhcpv6_client_ptr -> nx_dhcpv6_option_request.nx_op_code = (USHORT)option_code; + dhcpv6_client_ptr -> nx_dhcpv6_option_request.nx_option_length = (USHORT)option_length; - while (option_length && (i < NX_DHCPV6_MAX_OPTION_REQUEST_OPTIONS)) + /* Loop to process requested option. */ + while ((index + 2 <= option_length) && (i < NX_DHCPV6_MAX_OPTION_REQUEST_OPTIONS)) { - /* Clear out existing data. */ - dhcpv6_client_ptr -> nx_dhcpv6_option_request.nx_op_request[i] = 0; - /* Extract the option request which should be the next 2 bytes. */ - _nx_dhcpv6_server_utility_get_data(received_buffer + index, 2, &data); + _nx_dhcpv6_server_utility_get_data(option_data + index, 2, &data); dhcpv6_client_ptr -> nx_dhcpv6_option_request.nx_op_request[i] = (USHORT)data; /* Update all the length and index counters.*/ - option_length -= 2; index += 2; i++; - } return NX_SUCCESS; @@ -6274,7 +6292,7 @@ UINT option_length; /* FUNCTION RELEASE */ /* */ /* _nx_dhcpv6_process_elapsed_time PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -6286,8 +6304,9 @@ UINT option_length; /* INPUT */ /* */ /* dhcpv6_client_ptr Pointer to DHCPV6 client instance */ -/* received_buffer Pointer to packet buffer */ -/* length Size of packet buffer */ +/* option_code Option code */ +/* option_length Size of option data */ +/* option_data Pointer to option data */ /* */ /* OUTPUT */ /* */ @@ -6308,43 +6327,31 @@ UINT option_length; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* packet length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ -UINT _nx_dhcpv6_process_elapsed_time(NX_DHCPV6_CLIENT *dhcpv6_client_ptr, UCHAR *received_buffer, UINT length) +UINT _nx_dhcpv6_process_elapsed_time(NX_DHCPV6_CLIENT *dhcpv6_client_ptr, ULONG option_code, UINT option_length, UCHAR *option_data) { ULONG data; -UINT index; - index = 0; - /* Extract the option code which should be the next 2 bytes. */ - _nx_dhcpv6_server_utility_get_data(received_buffer + index, 2, &data); - dhcpv6_client_ptr -> nx_dhcpv6_elapsed_time.nx_op_code = (USHORT)data; + /* Set option code and length. */ + dhcpv6_client_ptr -> nx_dhcpv6_elapsed_time.nx_op_code = (USHORT)option_code; + dhcpv6_client_ptr -> nx_dhcpv6_elapsed_time.nx_option_length = (USHORT)option_length; - index += 2; - - /* Extract the option length which should be the next 2 bytes. */ - _nx_dhcpv6_server_utility_get_data(received_buffer + index, 2, &data); - dhcpv6_client_ptr -> nx_dhcpv6_elapsed_time.nx_option_length = (USHORT)data; - - index += 2; + /* Check option length for elapsed-time. */ + if (option_length != 2) + { + return(NX_DHCPV6_INVALID_OPTION_DATA); + } /* Extract the elapsed session time which should be the next 2 bytes. */ - _nx_dhcpv6_server_utility_get_data(received_buffer + index, 2, &data); + _nx_dhcpv6_server_utility_get_data(option_data, 2, &data); dhcpv6_client_ptr -> nx_dhcpv6_elapsed_time.nx_session_time = (USHORT)data; - index += 2; - - /* Are we past the end of the buffer, subtracting for the toplevel opcode and - length of the IANA option? */ - if ((index - 4) > length || (index - 4) < length) - { - - /* Yes, return the error status to reject this packet. */ - return NX_DHCPV6_INVALID_OPTION_DATA; - } - return NX_SUCCESS; } @@ -6354,7 +6361,7 @@ UINT index; /* FUNCTION RELEASE */ /* */ /* _nx_dhcpv6_server_process_ia PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -6366,8 +6373,9 @@ UINT index; /* INPUT */ /* */ /* dhcpv6_client_ptr Pointer to DHCPV6 Client instance */ -/* buffer_ptr Pointer to client packet buffer */ -/* length Size of client packet buffer */ +/* option_code Option code */ +/* option_length Size of option data */ +/* option_data Pointer to option data */ /* process_ia If true, write IA to client record*/ /* */ /* OUTPUT */ @@ -6390,12 +6398,15 @@ UINT index; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* packet length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ -UINT _nx_dhcpv6_server_process_ia(NX_DHCPV6_CLIENT *dhcpv6_client_ptr, UCHAR *received_buffer, UINT length, UINT process_ia) +UINT _nx_dhcpv6_server_process_ia(NX_DHCPV6_CLIENT *dhcpv6_client_ptr, ULONG option_code, UINT option_length, UCHAR *option_data, UINT process_ia) { -UINT index, k; +UINT index = 0, k; ULONG data; @@ -6403,63 +6414,50 @@ ULONG data; record, but use the server's data instead. */ if (process_ia) { - - dhcpv6_client_ptr -> nx_dhcpv6_ia.nx_op_code = NX_DHCPV6_OP_IA_ADDRESS; - dhcpv6_client_ptr -> nx_dhcpv6_ia.nx_option_length = (USHORT)length; + dhcpv6_client_ptr -> nx_dhcpv6_ia.nx_op_code = (USHORT)option_code; + dhcpv6_client_ptr -> nx_dhcpv6_ia.nx_option_length = (USHORT)option_length; } - /* Set the index for the read pointer past the option header. */ - index = 4; + /* Check option length for Ipv6 address (16 bytes), preferred-lifetime (4 bytes) and valid-lifetime (4 bytes). */ + if (option_length < 24) + { + return(NX_DHCPV6_INVALID_IA_DATA); + } - for (k = 0; k < sizeof(ULONG); k++) + /* Process IPv6 address. */ + for (k = 0; k < 4; k++) { /* Copy each IPv6 address word into the IA address. */ - _nx_dhcpv6_server_utility_get_data(received_buffer + index, sizeof(ULONG), &data); + _nx_dhcpv6_server_utility_get_data(option_data + index, sizeof(ULONG), &data); if (process_ia) { - dhcpv6_client_ptr -> nx_dhcpv6_ia.nx_global_address.nxd_ip_address.v6[k] = data; } /* Move to the next IPv6 address word. */ - index += (ULONG)sizeof(ULONG); - - /* Check if we're going past the end of the option data. */ - if (index - sizeof(ULONG) > length) - { - /* Yes, return an error status.*/ - return NX_DHCPV6_INVALID_IA_DATA; - } + index += 4; } /* Copy the preferred lifetime data from the client buffer to IA.*/ - _nx_dhcpv6_server_utility_get_data(received_buffer + index, sizeof(ULONG), &data); - + _nx_dhcpv6_server_utility_get_data(option_data + index, sizeof(ULONG), &data); if (process_ia) { - dhcpv6_client_ptr -> nx_dhcpv6_ia.nx_preferred_lifetime = data; - } - - index += (ULONG)sizeof(ULONG); + index += 4; /* Copy the valid lifetime data from the client buffer to IA.*/ - _nx_dhcpv6_server_utility_get_data(received_buffer + index, sizeof(ULONG), &data); - + _nx_dhcpv6_server_utility_get_data(option_data + index, sizeof(ULONG), &data); if (process_ia) { - dhcpv6_client_ptr -> nx_dhcpv6_ia.nx_valid_lifetime = data; - } - - index += (ULONG)sizeof(ULONG); + index += 4; /* Check if we went past the reported size of IA address data. */ - if (index - 4 > length || index - 4 < length) + if (index != option_length) { /* Return an error status. Cannot accept this reply. */ @@ -6475,7 +6473,7 @@ ULONG data; /* FUNCTION RELEASE */ /* */ /* _nx_dhcpv6_process_duid PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -6486,10 +6484,10 @@ ULONG data; /* */ /* INPUT */ /* */ -/* dhcpv6_client_ptr Pointer to DHCPV6 client instance */ -/* duid_type Denotes client or server DUID */ -/* received_buffer Pointer to packet buffer */ -/* length Size of packet buffer */ +/* duid_ptr Pointer to DHCPV6 DUID instance */ +/* option_code Option code */ +/* option_length Size of option data */ +/* option_data Pointer to option data */ /* */ /* OUTPUT */ /* */ @@ -6511,62 +6509,120 @@ ULONG data; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* packet length verification, */ +/* corrected the logic of */ +/* processing DUID type, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ -UINT _nx_dhcpv6_process_duid(NX_DHCPV6_SVR_DUID *duid_ptr, UINT duid_type, UCHAR *received_buffer, UINT length) +UINT _nx_dhcpv6_process_duid(NX_DHCPV6_SVR_DUID *duid_ptr, ULONG option_code, UINT option_length, UCHAR *option_data) { ULONG data; -UINT index; +UINT index = 0; - NX_PARAMETER_NOT_USED(duid_type); + NX_PARAMETER_NOT_USED(option_code); - /* Set an index past the option code and data length. */ - index = 4; + /* Check option length for DUID type. */ + if (option_length < 2) + { + return(NX_DHCPV6_INVALID_OPTION_DATA); + } /* Extract the DUID type which should be the next 2 bytes. */ - _nx_dhcpv6_server_utility_get_data(received_buffer + index, 2, &data); + _nx_dhcpv6_server_utility_get_data(option_data + index, 2, &data); duid_ptr -> nx_duid_type = (USHORT)data; - index += 2; - /* Extract the hardware type which should be the next 2 bytes. */ - _nx_dhcpv6_server_utility_get_data(received_buffer + index, 2, &data); + /* Check the duid type. */ + if ((duid_ptr -> nx_duid_type < NX_DHCPV6_SERVER_DUID_TYPE_LINK_TIME) || + (duid_ptr -> nx_duid_type > NX_DHCPV6_SERVER_DUID_TYPE_LINK_ONLY)) + { + return(NX_DHCPV6_INVALID_DUID); + } - duid_ptr -> nx_hardware_type = (USHORT)data; + /* Check if it is a link layer duid. */ + if ((duid_ptr -> nx_duid_type == NX_DHCPV6_SERVER_DUID_TYPE_LINK_TIME) || + (duid_ptr -> nx_duid_type == NX_DHCPV6_SERVER_DUID_TYPE_LINK_ONLY)) + { - index += 2; + /* Check option length for hardware type. */ + if (index + 2 > option_length) + { + return(NX_DHCPV6_INVALID_OPTION_DATA); + } - /* IS this a link layer plus time DUID type? */ - if (duid_ptr -> nx_duid_type == NX_DHCPV6_SERVER_DUID_TYPE_LINK_TIME) - { - - /* Yes; Extract the time which should be the next 4 bytes. */ - _nx_dhcpv6_server_utility_get_data(received_buffer + index, 4, &data); - - duid_ptr -> nx_duid_time = data; + /* Extract the hardware type which should be the next 2 bytes. */ + _nx_dhcpv6_server_utility_get_data(option_data + index, 2, &data); + duid_ptr -> nx_hardware_type = (USHORT)data; + index += 2; - index += 4; - } + /* IS this a link layer plus time DUID type? */ + if (duid_ptr -> nx_duid_type == NX_DHCPV6_SERVER_DUID_TYPE_LINK_TIME) + { - /* Extract the link local address msw which should be the next 2 bytes. */ - _nx_dhcpv6_server_utility_get_data(received_buffer + index, 2, &data); + /* Check option length for time. */ + if (index + 4 > option_length) + { + return(NX_DHCPV6_INVALID_OPTION_DATA); + } - index += 2; + /* Yes; Extract the time which should be the next 4 bytes. */ + _nx_dhcpv6_server_utility_get_data(option_data + index, 4, &data); + duid_ptr -> nx_duid_time = data; + index += 4; + } + + /* Check option length mac address. */ + if (index + 6 > option_length) + { + return(NX_DHCPV6_INVALID_OPTION_DATA); + } - duid_ptr -> nx_link_layer_address_msw = (USHORT)data; + /* Extract the link local address msw which should be the next 2 bytes. */ + _nx_dhcpv6_server_utility_get_data(option_data + index, 2, &data); + duid_ptr -> nx_link_layer_address_msw = (USHORT)data; + index += 2; - /* Extract the link local address lsw which should be the next 4 bytes. */ - _nx_dhcpv6_server_utility_get_data(received_buffer + index, 4, &data); + /* Extract the link local address lsw which should be the next 4 bytes. */ + _nx_dhcpv6_server_utility_get_data(option_data + index, 4, &data); + duid_ptr -> nx_link_layer_address_lsw = data; + index += 4; + } + else + { - index += 4; + /* DUID Assigned by Vendor Based on Enterprise Number. */ - duid_ptr -> nx_link_layer_address_lsw = data; + /* Check option length for enterprise-number. */ + if (index + 4 > option_length) + { + return(NX_DHCPV6_INVALID_DUID); + } + /* Extract the enterprise-number which should be the next 4 bytes. */ + _nx_dhcpv6_server_utility_get_data(option_data + index, 4, &data); + duid_ptr -> nx_duid_enterprise_number = data; + index += 4; + + /* Check the size of identifier. */ + if (option_length - 6 <= NX_DHCPV6_SERVER_DUID_VENDOR_ASSIGNED_LENGTH) + { + + /* Set the identifier. */ + memcpy(duid_ptr -> nx_duid_private_identifier, option_data + index, option_length - 6); /* Use case of memcpy is verified. */ + index = option_length; + } + else + { + return(NX_DHCPV6_INVALID_DUID); + } + } /* Are we past the end of the buffer, subtracting for the toplevel opcode and length of the IANA option? */ - if ((index - 4) > length || (index - 4) < length) + if (index != option_length) { /* Yes, return the error status to reject this packet. */ diff --git a/addons/dhcp/nxd_dhcpv6_server.h b/addons/dhcp/nxd_dhcpv6_server.h index ee01ba0e..ffc78fca 100644 --- a/addons/dhcp/nxd_dhcpv6_server.h +++ b/addons/dhcp/nxd_dhcpv6_server.h @@ -26,7 +26,7 @@ /* APPLICATION INTERFACE DEFINITION RELEASE */ /* */ /* nxd_dhcpv6_server.h PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -43,6 +43,9 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* packet length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ @@ -798,11 +801,11 @@ UINT _nx_dhcpv6_server_extract_packet_information(NX_DHCPV6_SERVER *dhcpv UINT iface_index, NXD_ADDRESS source_address, NXD_ADDRESS destination_address); UINT _nx_dhcpv6_listen_for_messages(NX_DHCPV6_SERVER *dhcpv6_ptr); UINT _nx_dhcpv6_prepare_iana_status(NX_DHCPV6_SERVER_IANA_STATUS *dhcpv6_status_ptr, UINT flag); -UINT _nx_dhcpv6_process_duid(NX_DHCPV6_SVR_DUID *duid_ptr, UINT duid_type, UCHAR *received_buffer, UINT length); -UINT _nx_dhcpv6_process_elapsed_time(NX_DHCPV6_CLIENT *dhcpv6_client_ptr, UCHAR *received_buffer, UINT length); -UINT _nx_dhcpv6_server_process_ia(NX_DHCPV6_CLIENT *dhcpv6_client_ptr, UCHAR *received_buffer, UINT length, UINT process_ia); -UINT _nx_dhcpv6_server_process_iana(NX_DHCPV6_CLIENT *dhcpv6_client_ptr, UCHAR *received_buffer, UINT length); -UINT _nx_dhcpv6_process_option_request(NX_DHCPV6_CLIENT *client_ptr, UCHAR *received_buffer, UINT length); +UINT _nx_dhcpv6_process_duid(NX_DHCPV6_SVR_DUID *duid_ptr, ULONG option_code, UINT option_length, UCHAR *option_data); +UINT _nx_dhcpv6_process_elapsed_time(NX_DHCPV6_CLIENT *dhcpv6_client_ptr, ULONG option_code, UINT option_length, UCHAR *option_data); +UINT _nx_dhcpv6_server_process_ia(NX_DHCPV6_CLIENT *dhcpv6_client_ptr, ULONG option_code, UINT option_length, UCHAR *option_data, UINT process_ia); +UINT _nx_dhcpv6_server_process_iana(NX_DHCPV6_CLIENT *dhcpv6_client_ptr, ULONG option_code, UINT option_length, UCHAR *option_data); +UINT _nx_dhcpv6_process_option_request(NX_DHCPV6_CLIENT *client_ptr, ULONG option_code, UINT option_length, UCHAR *option_data); UINT _nx_dhcpv6_send_response_to_client(NX_DHCPV6_SERVER *dhcpv6_server_ptr, NX_DHCPV6_CLIENT *dhcpv6_client_ptr); VOID _nx_dhcpv6_server_lease_timeout_entry(ULONG dhcpv6_server_ptr_value); VOID _nx_dhcpv6_server_thread_entry(ULONG ip_instance); diff --git a/addons/dns/nxd_dns.c b/addons/dns/nxd_dns.c index d5866bd2..bd4d4cee 100644 --- a/addons/dns/nxd_dns.c +++ b/addons/dns/nxd_dns.c @@ -3815,7 +3815,7 @@ UINT record_count = 0; /* FUNCTION RELEASE */ /* */ /* _nx_dns_host_resource_data_by_name_get PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -3858,6 +3858,9 @@ UINT record_count = 0; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), corrected*/ +/* the timeout of first query, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ static UINT _nx_dns_host_resource_data_by_name_get(NX_DNS *dns_ptr, UCHAR *host_name, @@ -3912,6 +3915,12 @@ UINT i; return(NX_DNS_NO_SERVER); } + /* Limit the timeout to NX_DNS_MAX_RETRANS_TIMEOUT. */ + if (wait_option > NX_DNS_MAX_RETRANS_TIMEOUT) + { + wait_option = NX_DNS_MAX_RETRANS_TIMEOUT; + } + /* Keep sending queries to all DNS Servers till the retry count expires. */ for (retries = 0; retries < dns_ptr -> nx_dns_retries; retries++) { @@ -3939,8 +3948,8 @@ UINT i; } /* Timed out for querying all DNS servers in this cycle, double the timeout, limited to NX_DNS_MAX_RETRANS_TIMEOUT. */ - if ((2 * wait_option) <= NX_DNS_MAX_RETRANS_TIMEOUT) - wait_option = wait_option * 2; + if (wait_option <= (NX_DNS_MAX_RETRANS_TIMEOUT >> 1)) + wait_option = (wait_option << 1); else wait_option = NX_DNS_MAX_RETRANS_TIMEOUT; } @@ -6418,7 +6427,7 @@ UINT size; /* FUNCTION RELEASE */ /* */ /* _nx_dns_process_soa_type PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -6459,6 +6468,9 @@ UINT size; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* and verified buffer size, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ static UINT _nx_dns_process_soa_type(NX_DNS *dns_ptr, NX_PACKET *packet_ptr, UCHAR *data_ptr, @@ -6511,6 +6523,12 @@ ULONG rr_ttl; /* Set the SRV entry pointer. */ nx_dns_soa_entry_ptr = (NX_DNS_SOA_ENTRY *)(record_buffer); + if (buffer_size <= sizeof(NX_DNS_SOA_ENTRY)) + { + /* The buffer size is not enough. */ + return(NX_DNS_MALFORMED_PACKET); + } + /* Update the start address of available buffer and the buffer size. */ buffer_start = record_buffer + sizeof(NX_DNS_SOA_ENTRY); buffer_size -= sizeof(NX_DNS_SOA_ENTRY); @@ -6541,7 +6559,13 @@ ULONG rr_ttl; /* Return !*/ return(NX_DNS_MALFORMED_PACKET); } - + + if (!buffer_size) + { + /* The buffer size is not enough. */ + return(NX_DNS_MALFORMED_PACKET); + } + /* Get the responsible mail address and record it in buffer. */ rname_length = _nx_dns_name_string_unencode(packet_ptr, data_ptr, buffer_start, buffer_size - 1); @@ -6932,7 +6956,7 @@ UINT _nxd_dns_host_by_address_get(NX_DNS *dns_ptr, NXD_ADDRESS *host_address_pt /* FUNCTION RELEASE */ /* */ /* _nx_dns_host_by_address_get_internal PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -6972,6 +6996,9 @@ UINT _nxd_dns_host_by_address_get(NX_DNS *dns_ptr, NXD_ADDRESS *host_address_pt /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), corrected*/ +/* the timeout of first query, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ static UINT _nx_dns_host_by_address_get_internal(NX_DNS *dns_ptr, NXD_ADDRESS *host_address_ptr, UCHAR *host_name_ptr, @@ -7121,7 +7148,13 @@ UINT length, index; return (NX_DNS_SUCCESS); } #endif /*NX_DNS_CACHE_ENABLE. */ - + + /* Limit the timeout to NX_DNS_MAX_RETRANS_TIMEOUT. */ + if (wait_option > NX_DNS_MAX_RETRANS_TIMEOUT) + { + wait_option = NX_DNS_MAX_RETRANS_TIMEOUT; + } + /* Keep sending queries to all DNS Servers till the retry count expires. */ for (retries = 0; retries < dns_ptr -> nx_dns_retries; retries++) { @@ -7131,7 +7164,7 @@ UINT length, index; /* Attempt host name resolution from each DNS server till one if found. */ for (i = 0; (i < NX_DNS_MAX_SERVERS) && (dns_ptr -> nx_dns_server_ip_array[i].nxd_ip_version != 0); i ++) { - + /* Send the PTR/reverse lookup query. */ status = _nx_dns_send_query_by_address(dns_ptr, &dns_ptr -> nx_dns_server_ip_array[i], &ip_question[0], host_name_ptr, host_name_buffer_size, wait_option); @@ -7147,12 +7180,12 @@ UINT length, index; return NX_SUCCESS; } } - + /* Timed out for querying all DNS servers in this cycle, double the timeout, limited to NX_DNS_MAX_RETRANS_TIMEOUT. */ - if ((2 * wait_option) <= NX_DNS_MAX_RETRANS_TIMEOUT) - wait_option = wait_option * 2; + if (wait_option <= (NX_DNS_MAX_RETRANS_TIMEOUT >> 1)) + wait_option = (wait_option << 1); else - wait_option = NX_DNS_MAX_RETRANS_TIMEOUT; + wait_option = NX_DNS_MAX_RETRANS_TIMEOUT; } /* Release protection. */ diff --git a/addons/http/nxd_http_server.c b/addons/http/nxd_http_server.c index fe66c208..c0dcdf79 100644 --- a/addons/http/nxd_http_server.c +++ b/addons/http/nxd_http_server.c @@ -6873,7 +6873,7 @@ UINT _nxe_http_server_get_entity_header(NX_HTTP_SERVER *server_ptr, NX_PACKET * /* FUNCTION RELEASE */ /* */ /* _nx_http_server_get_entity_header PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -6912,6 +6912,9 @@ UINT _nxe_http_server_get_entity_header(NX_HTTP_SERVER *server_ptr, NX_PACKET * /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* fixed write underflow, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_http_server_get_entity_header(NX_HTTP_SERVER *server_ptr, NX_PACKET **packet_pptr, UCHAR *entity_header_buffer, ULONG buffer_size) @@ -7181,7 +7184,16 @@ UINT index; /* Set terminal 0. */ if(entity_header_buffer) - entity_header_buffer[index - 4] = 0; + { + if (index >= 4) + { + entity_header_buffer[index - 4] = 0; + } + else + { + entity_header_buffer[0] = 0; + } + } return NX_SUCCESS; } else diff --git a/addons/mqtt/nxd_mqtt_client.c b/addons/mqtt/nxd_mqtt_client.c index 64b9349d..c3899002 100644 --- a/addons/mqtt/nxd_mqtt_client.c +++ b/addons/mqtt/nxd_mqtt_client.c @@ -1395,7 +1395,7 @@ ULONG bytes_copied; /* FUNCTION RELEASE */ /* */ /* _nxd_mqtt_process_publish_response PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -1432,6 +1432,9 @@ ULONG bytes_copied; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* added ack receive notify, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ static UINT _nxd_mqtt_process_publish_response(NXD_MQTT_CLIENT *client_ptr, NX_PACKET *packet_ptr) @@ -1477,6 +1480,15 @@ USHORT transmit_packet_id; /* Therefore we verify that packet contains PUBLISH packet with QoS level 1*/ if ((fixed_header & 0xF6) == ((MQTT_CONTROL_PACKET_TYPE_PUBLISH << 4) | MQTT_PUBLISH_QOS_LEVEL_1)) { + + /* Check ack notify function. */ + if (client_ptr -> nxd_mqtt_ack_receive_notify) + { + + /* Call notify function. Note: user routine should not release the packet. */ + client_ptr -> nxd_mqtt_ack_receive_notify(client_ptr, MQTT_CONTROL_PACKET_TYPE_PUBACK, packet_id, transmit_packet_ptr, client_ptr -> nxd_mqtt_ack_receive_context); + } + /* QoS Level1 message receives an ACK. */ /* This message can be released. */ _nxd_mqtt_release_transmit_packet(client_ptr, transmit_packet_ptr, previous_packet_ptr); @@ -1549,6 +1561,14 @@ USHORT transmit_packet_id; nx_packet_release(response_packet); } + /* Check ack notify function. */ + if (client_ptr -> nxd_mqtt_ack_receive_notify) + { + + /* Call notify function. Note: user routine should not release the packet. */ + client_ptr -> nxd_mqtt_ack_receive_notify(client_ptr, MQTT_CONTROL_PACKET_TYPE_PUBREL, packet_id, transmit_packet_ptr, client_ptr -> nxd_mqtt_ack_receive_context); + } + /* This packet can be released. */ _nxd_mqtt_release_transmit_packet(client_ptr, transmit_packet_ptr, previous_packet_ptr); @@ -1572,7 +1592,7 @@ USHORT transmit_packet_id; /* FUNCTION RELEASE */ /* */ /* _nxd_mqtt_process_sub_unsub_ack PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -1609,6 +1629,9 @@ USHORT transmit_packet_id; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* added ack receive notify, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ static UINT _nxd_mqtt_process_sub_unsub_ack(NXD_MQTT_CLIENT *client_ptr, NX_PACKET *packet_ptr) @@ -1665,6 +1688,14 @@ ULONG bytes_copied; return(1); } + /* Check ack notify function. */ + if (client_ptr -> nxd_mqtt_ack_receive_notify) + { + + /* Call notify function. Note: user routine should not release the packet. */ + client_ptr -> nxd_mqtt_ack_receive_notify(client_ptr, MQTT_CONTROL_PACKET_TYPE_SUBACK, packet_id, transmit_packet_ptr, client_ptr -> nxd_mqtt_ack_receive_context); + } + /* Release the transmit packet. */ _nxd_mqtt_release_transmit_packet(client_ptr, transmit_packet_ptr, previous_packet_ptr); @@ -1680,6 +1711,14 @@ ULONG bytes_copied; return(1); } + /* Check ack notify function. */ + if (client_ptr -> nxd_mqtt_ack_receive_notify) + { + + /* Call notify function. Note: user routine should not release the packet. */ + client_ptr -> nxd_mqtt_ack_receive_notify(client_ptr, MQTT_CONTROL_PACKET_TYPE_UNSUBACK, packet_id, transmit_packet_ptr, client_ptr -> nxd_mqtt_ack_receive_context); + } + /* Unsubscribe succeeded. */ /* Release the transmit packet. */ _nxd_mqtt_release_transmit_packet(client_ptr, transmit_packet_ptr, previous_packet_ptr); @@ -2590,7 +2629,7 @@ NXD_MQTT_CLIENT *client_ptr = (NXD_MQTT_CLIENT *)client; /* FUNCTION RELEASE */ /* */ /* _nxd_mqtt_client_event_process PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -2630,6 +2669,9 @@ NXD_MQTT_CLIENT *client_ptr = (NXD_MQTT_CLIENT *)client; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* corrected mqtt client state,*/ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ static VOID _nxd_mqtt_client_event_process(VOID *mqtt_client, ULONG common_events, ULONG module_own_events) @@ -2643,14 +2685,6 @@ NXD_MQTT_CLIENT *client_ptr = (NXD_MQTT_CLIENT *)mqtt_client; /* Process common events. */ NX_PARAMETER_NOT_USED(common_events); - /* Process module own events. */ - if (module_own_events & MQTT_START_EVENT) - { - - /* Move MQTT Client state to STARTED */ - client_ptr -> nxd_mqtt_client_state = NXD_MQTT_CLIENT_STATE_IDLE; - } - if (module_own_events & MQTT_TIMEOUT_EVENT) { /* Send out PING only if the client is connected. */ @@ -2869,7 +2903,7 @@ NXD_MQTT_CLIENT *client_ptr = (NXD_MQTT_CLIENT *)(socket_ptr -> nx_tcp_socket_re /* FUNCTION RELEASE */ /* */ /* _nxd_mqtt_client_create PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -2911,6 +2945,9 @@ NXD_MQTT_CLIENT *client_ptr = (NXD_MQTT_CLIENT *)(socket_ptr -> nx_tcp_socket_re /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* corrected mqtt client state,*/ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nxd_mqtt_client_create(NXD_MQTT_CLIENT *client_ptr, CHAR *client_name, @@ -2978,10 +3015,11 @@ UINT status; return(NXD_MQTT_INTERNAL_ERROR); } - /* Set start event to start MQTT. */ - nx_cloud_module_event_set(&(client_ptr -> nxd_mqtt_client_cloud_module), MQTT_START_EVENT); #endif /* NXD_MQTT_CLOUD_ENABLE */ + /* Update state. */ + client_ptr -> nxd_mqtt_client_state = NXD_MQTT_CLIENT_STATE_IDLE; + /* Return. */ return(NXD_MQTT_SUCCESS); } @@ -2992,7 +3030,7 @@ UINT status; /* FUNCTION RELEASE */ /* */ /* _nxd_mqtt_client_create_internal PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -3036,6 +3074,9 @@ UINT status; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* corrected mqtt client state,*/ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ static UINT _nxd_mqtt_client_create_internal(NXD_MQTT_CLIENT *client_ptr, CHAR *client_name, @@ -3129,14 +3170,10 @@ UINT status; /* Record the client_ptr in the socket structure. */ client_ptr -> nxd_mqtt_client_socket.nx_tcp_socket_reserved_ptr = (VOID *)client_ptr; - client_ptr -> nxd_mqtt_client_state = NXD_MQTT_CLIENT_STATE_INITIALIZE; - #ifndef NXD_MQTT_CLOUD_ENABLE /* Start MQTT thread. */ - tx_event_flags_set(&client_ptr -> nxd_mqtt_events, MQTT_START_EVENT, TX_OR); tx_thread_resume(&(client_ptr -> nxd_mqtt_thread)); #endif /* NXD_MQTT_CLOUD_ENABLE */ - return(NXD_MQTT_SUCCESS); } @@ -3571,7 +3608,7 @@ UCHAR fixed_header; /* FUNCTION RELEASE */ /* */ /* _nxd_mqtt_client_connect PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -3629,6 +3666,11 @@ UCHAR fixed_header; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* fixed return value when it */ +/* is set in CONNACK, corrected*/ +/* mqtt client state, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nxd_mqtt_client_connect(NXD_MQTT_CLIENT *client_ptr, NXD_ADDRESS *server_ip, UINT server_port, @@ -3636,6 +3678,9 @@ UINT _nxd_mqtt_client_connect(NXD_MQTT_CLIENT *client_ptr, NXD_ADDRESS *server_i { NX_PACKET *packet_ptr; UINT status; +TX_THREAD *thread_ptr; +UINT new_priority; +UINT old_priority; /* Obtain the mutex. */ @@ -3660,6 +3705,25 @@ UINT status; return(NXD_MQTT_ALREADY_CONNECTED); } + /* Check if client is connecting. */ + if (client_ptr -> nxd_mqtt_client_state == NXD_MQTT_CLIENT_STATE_CONNECTING) + { + tx_mutex_put(client_ptr -> nxd_mqtt_client_mutex_ptr); + return(NXD_MQTT_CONNECTING); + } + + /* Client state must be in IDLE. */ + if (client_ptr -> nxd_mqtt_client_state != NXD_MQTT_CLIENT_STATE_IDLE) + { +#ifdef NX_SECURE_ENABLE + if (client_ptr -> nxd_mqtt_client_use_tls) + { + nx_secure_tls_session_delete(&(client_ptr -> nxd_mqtt_tls_session)); + } +#endif /* NX_SECURE_ENABLE */ + return(NXD_MQTT_INVALID_STATE); + } + #if defined(NX_SECURE_ENABLE) && defined(NXD_MQTT_REQUIRE_TLS) if (!client_ptr -> nxd_mqtt_client_use_tls) { @@ -3790,6 +3854,16 @@ UINT status; return(NX_IN_PROGRESS); } + /* Increase priority to the same of internal thread to avoid out of order packet process. */ +#ifndef NXD_MQTT_CLOUD_ENABLE + thread_ptr = &(client_ptr -> nxd_mqtt_thread); +#else + thread_ptr = &(client_ptr -> nxd_mqtt_client_cloud_ptr -> nx_cloud_thread); +#endif /* NXD_MQTT_CLOUD_ENABLE */ + tx_thread_info_get(thread_ptr, NX_NULL, NX_NULL, NX_NULL, + &new_priority, NX_NULL, NX_NULL, NX_NULL, NX_NULL); + tx_thread_priority_change(tx_thread_identify(), new_priority, &old_priority); + /* If TLS is enabled, start TLS */ #ifdef NX_SECURE_ENABLE if (client_ptr -> nxd_mqtt_client_use_tls) @@ -3800,6 +3874,9 @@ UINT status; if (status != NX_SUCCESS) { + /* Revert thread priority. */ + tx_thread_priority_change(tx_thread_identify(), old_priority, &old_priority); + /* End connection. */ _nxd_mqtt_client_connection_end(client_ptr, NX_NO_WAIT); @@ -3814,6 +3891,9 @@ UINT status; if (status != NX_SUCCESS) { + /* Revert thread priority. */ + tx_thread_priority_change(tx_thread_identify(), old_priority, &old_priority); + /* End connection. */ _nxd_mqtt_client_connection_end(client_ptr, NX_NO_WAIT); @@ -3833,6 +3913,9 @@ UINT status; status = nx_tcp_socket_receive(&client_ptr -> nxd_mqtt_client_socket, &packet_ptr, wait_option); #endif /* NX_SECURE_ENABLE */ + /* Revert thread priority. */ + tx_thread_priority_change(tx_thread_identify(), old_priority, &old_priority); + /* Check status. */ if (status) { @@ -5142,7 +5225,7 @@ UINT _nxde_mqtt_client_create(NXD_MQTT_CLIENT *client_ptr, CHAR *client_name, CH /* FUNCTION RELEASE */ /* */ /* _nxde_mqtt_client_connect PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -5181,6 +5264,9 @@ UINT _nxde_mqtt_client_create(NXD_MQTT_CLIENT *client_ptr, CHAR *client_name, CH /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* corrected mqtt client state,*/ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nxde_mqtt_client_connect(NXD_MQTT_CLIENT *client_ptr, NXD_ADDRESS *server_ip, UINT server_port, @@ -5210,12 +5296,6 @@ UINT status; return(NX_INVALID_PORT); } - - if (client_ptr -> nxd_mqtt_client_state == NXD_MQTT_CLIENT_STATE_INITIALIZE) - { - return(NXD_MQTT_CLIENT_NOT_RUNNING); - } - status = _nxd_mqtt_client_connect(client_ptr, server_ip, server_port, keepalive, clean_session, wait_option); return(status); @@ -5226,7 +5306,7 @@ UINT status; /* FUNCTION RELEASE */ /* */ /* _nxde_mqtt_client_secure_connect PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -5267,6 +5347,9 @@ UINT status; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* corrected mqtt client state,*/ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ #ifdef NX_SECURE_ENABLE @@ -5294,11 +5377,6 @@ UINT status; return(NX_INVALID_PORT); } - if (client_ptr -> nxd_mqtt_client_state == NXD_MQTT_CLIENT_STATE_INITIALIZE) - { - return(NXD_MQTT_CLIENT_NOT_RUNNING); - } - status = _nxd_mqtt_client_secure_connect(client_ptr, server_ip, server_port, tls_setup, keepalive, clean_session, wait_option); @@ -5870,7 +5948,7 @@ UINT _nxde_mqtt_client_disconnect_notify_set(NXD_MQTT_CLIENT *client_ptr, VOID ( /* FUNCTION RELEASE */ /* */ /* _nxd_mqtt_client_cloud_create PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -5908,6 +5986,9 @@ UINT _nxde_mqtt_client_disconnect_notify_set(NXD_MQTT_CLIENT *client_ptr, VOID ( /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* corrected mqtt client state,*/ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nxd_mqtt_client_cloud_create(NXD_MQTT_CLIENT *client_ptr, CHAR *client_name, CHAR *client_id, UINT client_id_length, @@ -5956,8 +6037,8 @@ UINT status; return(NXD_MQTT_INTERNAL_ERROR); } - /* Set start event to start MQTT. */ - nx_cloud_module_event_set(&(client_ptr -> nxd_mqtt_client_cloud_module), MQTT_START_EVENT); + /* Update state. */ + client_ptr -> nxd_mqtt_client_state = NXD_MQTT_CLIENT_STATE_IDLE; return(NXD_MQTT_SUCCESS); } diff --git a/addons/mqtt/nxd_mqtt_client.h b/addons/mqtt/nxd_mqtt_client.h index f9be3d0b..7d7412ac 100644 --- a/addons/mqtt/nxd_mqtt_client.h +++ b/addons/mqtt/nxd_mqtt_client.h @@ -26,7 +26,7 @@ /* APPLICATION INTERFACE DEFINITION RELEASE */ /* */ /* nxd_mqtt_client.h PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -42,6 +42,9 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* added ack receive notify, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ @@ -271,6 +274,8 @@ typedef struct MQTT_PACKET_DISCONNECT_STRUCT #define NXD_MQTT_CLIENT_NOT_RUNNING 0x1000E #define NXD_MQTT_INVALID_PACKET 0x1000F #define NXD_MQTT_PARTIAL_PACKET 0x10010 +#define NXD_MQTT_CONNECTING 0x10011 +#define NXD_MQTT_INVALID_STATE 0x10012 /* The following error codes match the Connect Return code in CONNACK message. */ #define NXD_MQTT_ERROR_CONNECT_RETURN_CODE 0x10080 @@ -332,6 +337,8 @@ typedef struct NXD_MQTT_CLIENT_STRUCT VOID (*nxd_mqtt_disconnect_notify)(struct NXD_MQTT_CLIENT_STRUCT *client_ptr); UINT (*nxd_mqtt_packet_receive_notify)(struct NXD_MQTT_CLIENT_STRUCT *client_ptr, NX_PACKET *packet_ptr, VOID *context); VOID *nxd_mqtt_packet_receive_context; + VOID (*nxd_mqtt_ack_receive_notify)(struct NXD_MQTT_CLIENT_STRUCT *client_ptr, UINT type, USHORT packet_id, NX_PACKET *transmit_packet_ptr, VOID *context); + VOID *nxd_mqtt_ack_receive_context; #ifdef NX_SECURE_ENABLE UINT nxd_mqtt_client_use_tls; UINT (*nxd_mqtt_tls_setup)(struct NXD_MQTT_CLIENT_STRUCT *, NX_SECURE_TLS_SESSION *, diff --git a/addons/snmp/nxd_snmp.c b/addons/snmp/nxd_snmp.c index dc0ee3ee..593e753c 100644 --- a/addons/snmp/nxd_snmp.c +++ b/addons/snmp/nxd_snmp.c @@ -16836,7 +16836,7 @@ ULONG temp; /* FUNCTION RELEASE */ /* */ /* _nx_snmp_version_1_process PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -16888,6 +16888,9 @@ ULONG temp; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* variable len verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ VOID _nx_snmp_version_1_process(NX_SNMP_AGENT *agent_ptr, NX_PACKET *packet_ptr) @@ -17433,8 +17436,9 @@ INT buffer_length; total_variable_length = variable_length + length; /* Determine if this variable will fit in the remaining length of the - variable list. */ - if ((length == 0) || (total_variable_length > variable_list_length)) + variable list, buffer length, and if there is integer overflow. */ + if ((length == 0) || (total_variable_length > variable_list_length) || + (total_variable_length < variable_length) || (total_variable_length > (UINT)buffer_length)) { /* Increment the invalid packet error counter. */ @@ -17847,7 +17851,7 @@ INT buffer_length; /* FUNCTION RELEASE */ /* */ /* _nx_snmp_version_2_process PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -17899,6 +17903,9 @@ INT buffer_length; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* variable len verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ VOID _nx_snmp_version_2_process(NX_SNMP_AGENT *agent_ptr, NX_PACKET *packet_ptr) @@ -18449,8 +18456,9 @@ INT buffer_length; total_variable_length = variable_length + length; /* Determine if this variable will fit in the remaining length of the - variable list. */ - if ((length == 0) || (total_variable_length > variable_list_length)) + variable list, buffer length, and if there is integer overflow. */ + if ((length == 0) || (total_variable_length > variable_list_length) || + (total_variable_length < variable_length) || (total_variable_length > (UINT)buffer_length)) { /* Increment the invalid packet error counter. */ @@ -23583,7 +23591,7 @@ VOID _nx_snmp_agent_security_response_status(NX_SNMP_AGENT *agent_ptr, UINT *aut /* FUNCTION RELEASE */ /* */ /* _nx_snmp_asn1_tlv_block_parse PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -23620,6 +23628,9 @@ VOID _nx_snmp_agent_security_response_status(NX_SNMP_AGENT *agent_ptr, UINT *aut /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), improved */ +/* buffer length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_snmp_utility_tlv_block_parse(UCHAR *buffer, INT buffer_length, USHORT *tlv_type, @@ -23715,7 +23726,7 @@ ULONG length_bytes; *header_length = *header_length + length_bytes; /* Check the buffer length. */ - if ((INT)(current_index + length_bytes) > buffer_length) + if ((current_index + length_bytes) < current_index || (current_index + length_bytes) > (UINT)buffer_length) { return(NX_SNMP_ERROR_WRONGLENGTH); } @@ -23742,7 +23753,8 @@ ULONG length_bytes; *tlv_length = length; /* Check the buffer length. */ - if ((INT)current_index >= buffer_length) + if (current_index >= (UINT)buffer_length || (length + current_index) < current_index || + (length + current_index) > (UINT)buffer_length) { return(NX_SNMP_ERROR_WRONGLENGTH); } diff --git a/addons/sntp/nxd_sntp_client.c b/addons/sntp/nxd_sntp_client.c index ccaf4967..edc276e3 100644 --- a/addons/sntp/nxd_sntp_client.c +++ b/addons/sntp/nxd_sntp_client.c @@ -4271,7 +4271,7 @@ ULONG *buffer; /* FUNCTION RELEASE */ /* */ /* _nx_sntp_client_utility_convert_seconds_to_date PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -4313,6 +4313,9 @@ ULONG *buffer; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* fixed leap year calculation,*/ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_sntp_client_utility_convert_seconds_to_date(NX_SNTP_TIME *current_NTP_time_ptr, UINT current_year, @@ -4330,6 +4333,7 @@ UINT seconds_diff; UINT years_diff; UINT leapyears_diff; UINT leaps; +UINT seconds_of_year; UINT seconds_into_currentyear; UINT seconds_into_currentmonth; UINT seconds_into_currentday; @@ -4356,13 +4360,15 @@ UINT seconds_into_currenthour; if (leaps == 0 ) { /* It is! */ - current_date_time_ptr -> leap_year = NX_TRUE; + current_date_time_ptr -> leap_year = NX_TRUE; + seconds_of_year = SECONDS_PER_LEAPYEAR; } else { /* Not a leap year. Clear the leap year flag. */ current_date_time_ptr -> leap_year = NX_FALSE; + seconds_of_year = SECONDS_PER_NONLEAPYEAR; } /* Compute number of seconds into the current year e.g. as of 01/01 at midnite by subtracting @@ -4373,7 +4379,7 @@ UINT seconds_into_currenthour; current_year++; - }while(seconds_into_currentyear > SECONDS_PER_NONLEAPYEAR); + }while(seconds_into_currentyear > seconds_of_year); /* Initialize month to January till we find out what the month is. */ current_date_time_ptr -> month = JANUARY; diff --git a/addons/web/nx_tcpserver.c b/addons/web/nx_tcpserver.c index 09e51630..a48bd50e 100644 --- a/addons/web/nx_tcpserver.c +++ b/addons/web/nx_tcpserver.c @@ -45,7 +45,7 @@ static VOID _nx_tcpserver_thread_entry(ULONG tcpserver_address); /* FUNCTION RELEASE */ /* */ /* _nx_tcpserver_session_allocate PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -79,6 +79,9 @@ static VOID _nx_tcpserver_thread_entry(ULONG tcpserver_address); /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* fixed packet leak issue, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ static UINT _nx_tcpserver_session_allocate(NX_TCPSERVER *server_ptr, NX_TCP_SESSION **session_pptr) @@ -108,6 +111,9 @@ NX_TCP_SOCKET *socket_ptr; /* Reset expiration to zero. */ server_ptr -> nx_tcpserver_sessions[i].nx_tcp_session_expiration = 0; + /* Set connection flag to false. */ + server_ptr -> nx_tcpserver_sessions[i].nx_tcp_session_connected = NX_FALSE; + /* Return the socket. */ *session_pptr = &server_ptr -> nx_tcpserver_sessions[i]; return NX_SUCCESS; @@ -810,7 +816,7 @@ NX_TCPSERVER *server_ptr = (NX_TCPSERVER *)tcpserver_address; /* FUNCTION RELEASE */ /* */ /* _nx_tcpserver_connect_process PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -847,6 +853,9 @@ NX_TCPSERVER *server_ptr = (NX_TCPSERVER *)tcpserver_address; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* fixed packet leak issue, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ static VOID _nx_tcpserver_connect_process(NX_TCPSERVER *server_ptr) @@ -894,14 +903,17 @@ NX_TCP_SESSION *session_ptr = NX_NULL; } } + /* If session is connected, just return. */ + if (server_ptr -> nx_tcpserver_listen_session -> nx_tcp_session_connected) + { + return; + } + /* Accept connection. */ status = nx_tcp_server_socket_accept(&server_ptr -> nx_tcpserver_listen_session -> nx_tcp_session_socket, server_ptr -> nx_tcpserver_accept_wait_option); if(status == NX_SUCCESS) { - - /* Set default expiration. */ - server_ptr -> nx_tcpserver_listen_session -> nx_tcp_session_expiration = server_ptr -> nx_tcpserver_timeout; #ifdef NX_TCPSERVER_ENABLE_TLS /* If TLS, start the TLS handshake. */ @@ -912,6 +924,7 @@ NX_TCP_SESSION *session_ptr = NX_NULL; if(status != NX_SUCCESS) { + nx_secure_tls_session_end(&server_ptr -> nx_tcpserver_listen_session -> nx_tcp_session_tls_session, NX_WAIT_FOREVER); nx_tcp_server_socket_unaccept(&server_ptr -> nx_tcpserver_listen_session -> nx_tcp_session_socket); } } @@ -919,6 +932,10 @@ NX_TCP_SESSION *session_ptr = NX_NULL; if (status == NX_SUCCESS) #endif { + + /* Set default expiration. */ + server_ptr -> nx_tcpserver_listen_session -> nx_tcp_session_expiration = server_ptr -> nx_tcpserver_timeout; + if(server_ptr -> nx_tcpserver_new_connection) { @@ -926,6 +943,9 @@ NX_TCP_SESSION *session_ptr = NX_NULL; server_ptr -> nx_tcpserver_new_connection(server_ptr, server_ptr -> nx_tcpserver_listen_session); } + /* Set connection flag to true. */ + server_ptr -> nx_tcpserver_listen_session -> nx_tcp_session_connected = NX_TRUE; + /* Clear listen socket. */ server_ptr -> nx_tcpserver_listen_session = NX_NULL; } @@ -1014,7 +1034,7 @@ NX_TCP_SOCKET *socket_ptr; /* FUNCTION RELEASE */ /* */ /* _nx_tcpserver_disconnect_process PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -1047,6 +1067,9 @@ NX_TCP_SOCKET *socket_ptr; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* fixed packet leak issue, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ static VOID _nx_tcpserver_disconnect_process(NX_TCPSERVER *server_ptr) @@ -1076,6 +1099,9 @@ NX_TCP_SOCKET *socket_ptr; /* Reset epiration of session. */ server_ptr -> nx_tcpserver_sessions[i].nx_tcp_session_expiration = 0; + /* Set connection flag to false. */ + server_ptr -> nx_tcpserver_sessions[i].nx_tcp_session_connected = NX_FALSE; + /* Relisten */ _nx_tcpserver_relisten(server_ptr); } @@ -1087,7 +1113,7 @@ NX_TCP_SOCKET *socket_ptr; /* FUNCTION RELEASE */ /* */ /* _nx_tcpserver_timeout_process PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -1121,6 +1147,9 @@ NX_TCP_SOCKET *socket_ptr; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* fixed packet leak issue, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ static VOID _nx_tcpserver_timeout_process(NX_TCPSERVER *server_ptr) @@ -1162,6 +1191,9 @@ NX_TCP_SESSION *session_ptr; /* Invoke timeout callback. */ server_ptr -> nx_tcpserver_connection_timeout(server_ptr, &server_ptr -> nx_tcpserver_sessions[i]); + /* Set connection flag to false. */ + session_ptr -> nx_tcp_session_connected = NX_FALSE; + /* Relisten */ _nx_tcpserver_relisten(server_ptr); } diff --git a/addons/web/nx_tcpserver.h b/addons/web/nx_tcpserver.h index 234a0d62..54e880d9 100644 --- a/addons/web/nx_tcpserver.h +++ b/addons/web/nx_tcpserver.h @@ -24,7 +24,7 @@ /* APPLICATION INTERFACE DEFINITION RELEASE */ /* */ /* nx_tcpserver.h PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -39,6 +39,9 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* fixed packet leak issue, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ @@ -93,6 +96,9 @@ typedef struct NX_TCP_SESSION_STRUCT /* Expiration timeout for this socket. */ ULONG nx_tcp_session_expiration; + /* Connection flag. */ + UINT nx_tcp_session_connected; + /* Reserved value for passing data to/from individual sessions. */ ULONG nx_tcp_session_reserved; diff --git a/addons/web/nx_web_http_server.c b/addons/web/nx_web_http_server.c index f0d77229..2e3a3bd7 100644 --- a/addons/web/nx_web_http_server.c +++ b/addons/web/nx_web_http_server.c @@ -7311,7 +7311,7 @@ UINT _nxe_web_http_server_get_entity_header(NX_WEB_HTTP_SERVER *server_ptr, NX_ /* FUNCTION RELEASE */ /* */ /* _nx_web_http_server_get_entity_header PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -7350,6 +7350,9 @@ UINT _nxe_web_http_server_get_entity_header(NX_WEB_HTTP_SERVER *server_ptr, NX_ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), and */ +/* fixed write underflow, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_web_http_server_get_entity_header(NX_WEB_HTTP_SERVER *server_ptr, NX_PACKET **packet_pptr, UCHAR *entity_header_buffer, ULONG buffer_size) @@ -7652,7 +7655,16 @@ UINT index; /* Set terminal 0. */ if(entity_header_buffer) - entity_header_buffer[index - 4] = 0; + { + if (index >= 4) + { + entity_header_buffer[index - 4] = 0; + } + else + { + entity_header_buffer[0] = 0; + } + } return NX_SUCCESS; } else diff --git a/common/inc/nx_api.h b/common/inc/nx_api.h index 36be74a0..49bbc8f7 100644 --- a/common/inc/nx_api.h +++ b/common/inc/nx_api.h @@ -26,7 +26,7 @@ /* APPLICATION INTERFACE DEFINITION RELEASE */ /* */ /* nx_api.h PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -45,6 +45,10 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), fixed */ +/* ThreadX version check, */ +/* updated product constants, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ @@ -91,7 +95,7 @@ extern "C" { #include "tx_trace.h" /* Define symbols for compatibility before and after ThreadX 5.8. */ -#if (((THREADX_MAJOR_VERSION << 16) | THREADX_MINOR_VERSION) >= 0x0508) +#if (((THREADX_MAJOR_VERSION << 8) | THREADX_MINOR_VERSION) >= 0x0508) #define NX_CLEANUP_PARAMETER , ULONG suspension_sequence #define NX_CLEANUP_ARGUMENT , 0 #define NX_CLEANUP_EXTENSION NX_PARAMETER_NOT_USED(suspension_sequence); @@ -99,7 +103,7 @@ extern "C" { #define NX_CLEANUP_PARAMETER #define NX_CLEANUP_ARGUMENT #define NX_CLEANUP_EXTENSION -#endif /* (((THREADX_MAJOR_VERSION << 16) | THREADX_MINOR_VERSION) >= 0x0508) */ +#endif /* (((THREADX_MAJOR_VERSION << 8) | THREADX_MINOR_VERSION) >= 0x0508) */ /* Define the get system state macro. By default, it simply maps to the variable _tx_thread_system_state. */ #ifndef TX_THREAD_GET_SYSTEM_STATE @@ -449,11 +453,13 @@ VOID _nx_trace_event_update(TX_TRACE_BUFFER_ENTRY *event, ULONG timestamp, ULONG /* Define basic constants for the NetX TCP/IP Stack. */ -#define EL_PRODUCT_NETXDUO +#define AZURE_RTOS_NETXDUO #define NETXDUO_MAJOR_VERSION 6 #define NETXDUO_MINOR_VERSION 0 +#define NETXDUO_PATCH_VERSION 1 -/* Define the following symbosl for backward compatibility */ +/* Define the following symbols for backward compatibility */ +#define EL_PRODUCT_NETXDUO #define __PRODUCT_NETXDUO__ #define __NETXDUO_MAJOR_VERSION__ NETXDUO_MAJOR_VERSION #define __NETXDUO_MINOR_VERSION__ NETXDUO_MINOR_VERSION diff --git a/common/src/nx_ip_dispatch_process.c b/common/src/nx_ip_dispatch_process.c index b62e77c6..499d4e0e 100644 --- a/common/src/nx_ip_dispatch_process.c +++ b/common/src/nx_ip_dispatch_process.c @@ -43,7 +43,7 @@ /* FUNCTION RELEASE */ /* */ /* _nx_ip_dispatch_process PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Yuxin Zhou, Microsoft Corporation */ @@ -95,6 +95,9 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Yuxin Zhou Initial Version 6.0 */ +/* 06-30-2020 Yuxin Zhou Modified comment(s), fixed */ +/* destination header check, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_ip_dispatch_process(NX_IP *ip_ptr, NX_PACKET *packet_ptr, UINT protocol) @@ -174,12 +177,13 @@ NX_ICMPV6_HEADER *icmp_header_ptr; case NX_PROTOCOL_NEXT_HEADER_DESTINATION: /* Invalid header option if we have already processed 1 destination option. */ - if (packet_ptr -> nx_packet_destination_header == 1) + if (packet_ptr -> nx_packet_destination_header >= 1) { /* If we already have processed one destination option, we expect this to be the second one. */ - if (packet_ptr -> nx_packet_option_state < (UCHAR)DESTINATION_HEADER_1) + if ((packet_ptr -> nx_packet_option_state < (UCHAR)DESTINATION_HEADER_1) || + (packet_ptr -> nx_packet_destination_header > 1)) { drop_packet = 1; } diff --git a/crypto_libraries/inc/nx_crypto.h b/crypto_libraries/inc/nx_crypto.h index 1a6b47b9..5bfbcea1 100644 --- a/crypto_libraries/inc/nx_crypto.h +++ b/crypto_libraries/inc/nx_crypto.h @@ -26,7 +26,7 @@ /* COMPONENT DEFINITION RELEASE */ /* */ /* nx_crypto.h PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -40,6 +40,9 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s),disabled */ +/* unaligned access by default */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ @@ -55,7 +58,6 @@ extern "C" { #endif - #include "nx_api.h" #include "nx_crypto_const.h" diff --git a/crypto_libraries/inc/nx_crypto_ec.h b/crypto_libraries/inc/nx_crypto_ec.h index 4beec9c7..c7a4c937 100644 --- a/crypto_libraries/inc/nx_crypto_ec.h +++ b/crypto_libraries/inc/nx_crypto_ec.h @@ -26,7 +26,7 @@ /* APPLICATION INTERFACE DEFINITION RELEASE */ /* */ /* nx_crypto_ec.h PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -41,6 +41,9 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), and */ +/* added public key validation,*/ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ @@ -301,6 +304,12 @@ NX_CRYPTO_KEEP UINT _nx_crypto_ec_key_pair_stream_generate(NX_CRYPTO_EC *curve, ULONG output_length_in_byte, ULONG *actual_output_length, HN_UBASE *scratch); +#ifndef NX_CRYPTO_ECC_DISABLE_KEY_VALIDATION +UINT _nx_crypto_ec_validate_public_key(NX_CRYPTO_EC_POINT *public_key, + NX_CRYPTO_EC *chosen_curve, + UINT partial, + HN_UBASE *scratch); +#endif /* NX_CRYPTO_ECC_DISABLE_KEY_VALIDATION */ UINT _nx_crypto_method_ec_secp192r1_operation(UINT op, VOID *handle, diff --git a/crypto_libraries/src/nx_crypto_aes.c b/crypto_libraries/src/nx_crypto_aes.c index 1b82e7e5..2b6fc3b3 100644 --- a/crypto_libraries/src/nx_crypto_aes.c +++ b/crypto_libraries/src/nx_crypto_aes.c @@ -981,7 +981,7 @@ ULONG val; /* FUNCTION RELEASE */ /* */ /* _nx_crypto_aes_encrypt PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -1027,13 +1027,16 @@ ULONG val; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), disabled */ +/* unaligned access by default,*/ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ NX_CRYPTO_KEEP UINT _nx_crypto_aes_encrypt(NX_CRYPTO_AES *aes_ptr, UCHAR *input, UCHAR *output, UINT length) { UINT num_rounds; UINT *w; -#ifdef NX_CRYPTO_DISABLE_UNALIGNED_ACCESS +#ifndef NX_CRYPTO_ENABLE_UNALIGNED_ACCESS UCHAR *aes_state; #else UINT *buf; @@ -1051,7 +1054,7 @@ UINT *buf; return(NX_INVALID_PARAMETERS); } -#ifdef NX_CRYPTO_DISABLE_UNALIGNED_ACCESS +#ifndef NX_CRYPTO_ENABLE_UNALIGNED_ACCESS aes_state = (UCHAR *)aes_ptr -> nx_crypto_aes_state; aes_state[0] = input[0]; aes_state[1] = input[1]; @@ -1084,7 +1087,7 @@ UINT *buf; _nx_crypto_aes_sub_shift_roundkey(aes_ptr, &w[num_rounds * 4]); -#ifdef NX_CRYPTO_DISABLE_UNALIGNED_ACCESS +#ifndef NX_CRYPTO_ENABLE_UNALIGNED_ACCESS output[0] = aes_state[0]; output[1] = aes_state[1]; output[2] = aes_state[2]; @@ -1476,7 +1479,7 @@ UINT num_rounds; UINT round; UINT *w; UINT *v; -#ifdef NX_CRYPTO_DISABLE_UNALIGNED_ACCESS +#ifndef NX_CRYPTO_ENABLE_UNALIGNED_ACCESS UCHAR *aes_state; #else UINT *buf; @@ -1488,7 +1491,7 @@ UINT *buf; w = aes_ptr -> nx_crypto_aes_decrypt_key_schedule; v = aes_ptr -> nx_crypto_aes_key_schedule; -#ifdef NX_CRYPTO_DISABLE_UNALIGNED_ACCESS +#ifndef NX_CRYPTO_ENABLE_UNALIGNED_ACCESS aes_state = (UCHAR *)aes_ptr -> nx_crypto_aes_state; aes_state[0] = input[0]; aes_state[1] = input[1]; @@ -1533,7 +1536,7 @@ UINT *buf; _nx_crypto_aes_inv_sub_shift_roundkey(aes_ptr, &w[0]); /* Extract the output encrypted block. */ -#ifdef NX_CRYPTO_DISABLE_UNALIGNED_ACCESS +#ifndef NX_CRYPTO_ENABLE_UNALIGNED_ACCESS output[0] = aes_state[0]; output[1] = aes_state[1]; output[2] = aes_state[2]; diff --git a/crypto_libraries/src/nx_crypto_cbc.c b/crypto_libraries/src/nx_crypto_cbc.c index 5608f0d6..e9ec1800 100644 --- a/crypto_libraries/src/nx_crypto_cbc.c +++ b/crypto_libraries/src/nx_crypto_cbc.c @@ -164,7 +164,7 @@ UINT i; } /* Store the last cipher for next round. */ - NX_CRYPTO_MEMCPY(cbc_metadata -> nx_crypto_cbc_last_block, last_cipher, block_size); + NX_CRYPTO_MEMCPY(cbc_metadata -> nx_crypto_cbc_last_block, last_cipher, block_size); return(NX_CRYPTO_SUCCESS); } @@ -249,7 +249,7 @@ UINT i; { /* If input == output, the xor clobbers the input buffer so we need to save off our last ciphertext before doing the xor. */ - NX_CRYPTO_MEMCPY(save_input, &input[i], block_size); + NX_CRYPTO_MEMCPY(save_input, &input[i], block_size); /* Decrypt the block. */ crypto_function(crypto_metadata, &input[i], &output[i], block_size); @@ -257,7 +257,7 @@ UINT i; /* XOR. */ _nx_crypto_cbc_xor(&output[i], last_cipher, &output[i], block_size); - NX_CRYPTO_MEMCPY(last_cipher, save_input, block_size); + NX_CRYPTO_MEMCPY(last_cipher, save_input, block_size); } #ifdef NX_SECURE_KEY_CLEAR @@ -319,7 +319,7 @@ NX_CRYPTO_KEEP UINT _nx_crypto_cbc_encrypt_init(NX_CRYPTO_CBC *cbc_metadata, UCH } /* Copy IV to last cipher. */ - NX_CRYPTO_MEMCPY(cbc_metadata -> nx_crypto_cbc_last_block, iv, iv_len); + NX_CRYPTO_MEMCPY(cbc_metadata -> nx_crypto_cbc_last_block, iv, iv_len); return(NX_CRYPTO_SUCCESS); } diff --git a/crypto_libraries/src/nx_crypto_ccm.c b/crypto_libraries/src/nx_crypto_ccm.c index 4e2cab5f..9ab121c9 100644 --- a/crypto_libraries/src/nx_crypto_ccm.c +++ b/crypto_libraries/src/nx_crypto_ccm.c @@ -27,7 +27,7 @@ /* FUNCTION RELEASE */ /* */ /* _nx_crypto_ccm_xor PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -60,11 +60,14 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), disabled */ +/* unaligned access by default,*/ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ NX_CRYPTO_KEEP static VOID _nx_crypto_ccm_xor(UCHAR *plaintext, UCHAR *key, UCHAR *ciphertext) { -#ifndef NX_CRYPTO_DISABLE_UNALIGNED_ACCESS +#ifdef NX_CRYPTO_ENABLE_UNALIGNED_ACCESS UINT *p = (UINT *)plaintext; UINT *c = (UINT *)ciphertext; UINT *k = (UINT *)key; @@ -145,7 +148,7 @@ NX_CRYPTO_KEEP static VOID _nx_crypto_ccm_cbc_pad(VOID *crypto_metadata, UINT i = 0; UCHAR last_cipher[NX_CRYPTO_CCM_BLOCK_SIZE]; - NX_CRYPTO_MEMCPY(last_cipher, iv, block_size); + NX_CRYPTO_MEMCPY(last_cipher, iv, block_size); for (i = 0; i < length; i += block_size) { @@ -154,7 +157,7 @@ UCHAR last_cipher[NX_CRYPTO_CCM_BLOCK_SIZE]; { /* If the length of this block is less than block size, pad it with zero. */ - NX_CRYPTO_MEMCPY(output, input + i, length - i); + NX_CRYPTO_MEMCPY(output, input + i, length - i); NX_CRYPTO_MEMSET(output + length - i, 0, block_size - (length - i)); _nx_crypto_ccm_xor(output, last_cipher, output); } @@ -168,7 +171,7 @@ UCHAR last_cipher[NX_CRYPTO_CCM_BLOCK_SIZE]; } /* Return last block of the cipher. */ - NX_CRYPTO_MEMCPY(output, last_cipher, block_size); + NX_CRYPTO_MEMCPY(output, last_cipher, block_size); #ifdef NX_SECURE_KEY_CLEAR NX_CRYPTO_MEMSET(last_cipher, 0, sizeof(last_cipher)); @@ -210,7 +213,7 @@ UCHAR temp_len = 0; /* B(0) = Flags||Nonce||l(m) */ B[0] = Flags; - NX_CRYPTO_MEMCPY(B + 1, Nonce, (UINT)15 - L); + NX_CRYPTO_MEMCPY(B + 1, Nonce, (UINT)15 - L); B[14] = (UCHAR)(m_len >> 8); B[15] = (UCHAR)(m_len); @@ -223,7 +226,7 @@ UCHAR temp_len = 0; /* If the length of string a is less than 14, pad B(1) with 0. */ temp_len = (UCHAR)((a_len > (block_size - 2)) ? (block_size - 2) : a_len); - NX_CRYPTO_MEMCPY(B + 2, a_data, (UINT)temp_len); + NX_CRYPTO_MEMCPY(B + 2, a_data, (UINT)temp_len); /* Get the CBC-MAC value X(2). */ _nx_crypto_ccm_cbc_pad(crypto_metadata, crypto_function, B, X, (UINT)(temp_len + 2), X, block_size); @@ -324,7 +327,7 @@ UCHAR *A = ccm_metadata -> nx_crypto_ccm_A; /* Create A(i) = Flags||Nonce||Counter i, for i = 0, 1, 2,.... */ Flags = (UCHAR)(L - 1); A[0] = Flags; - NX_CRYPTO_MEMCPY(A + 1, Nonce, (UINT)(15 - L)); + NX_CRYPTO_MEMCPY(A + 1, Nonce, (UINT)(15 - L)); return(NX_CRYPTO_SUCCESS); } @@ -498,7 +501,7 @@ UINT i; { /* The authentication tag T is the leftmost M bytes of the CBC-MAC value X(t + 1). */ - NX_CRYPTO_MEMCPY(icv, ccm_metadata -> nx_crypto_ccm_X, ccm_metadata -> nx_crypto_ccm_icv_length); + NX_CRYPTO_MEMCPY(icv, ccm_metadata -> nx_crypto_ccm_X, ccm_metadata -> nx_crypto_ccm_icv_length); /* Get encryption block X. */ A[15] = 0; @@ -576,7 +579,7 @@ UINT i; if (ccm_metadata -> nx_crypto_ccm_icv_length > 0) { - NX_CRYPTO_MEMCPY(temp, ccm_metadata -> nx_crypto_ccm_A, block_size); + NX_CRYPTO_MEMCPY(temp, ccm_metadata -> nx_crypto_ccm_A, block_size); temp[15] = 0; crypto_function(crypto_metadata, temp, temp, block_size); diff --git a/crypto_libraries/src/nx_crypto_ctr.c b/crypto_libraries/src/nx_crypto_ctr.c index 96cf6558..f5efff68 100644 --- a/crypto_libraries/src/nx_crypto_ctr.c +++ b/crypto_libraries/src/nx_crypto_ctr.c @@ -27,7 +27,7 @@ /* FUNCTION RELEASE */ /* */ /* _nx_crypto_ctr_xor PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -59,11 +59,14 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), disabled */ +/* unaligned access by default,*/ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ NX_CRYPTO_KEEP static VOID _nx_crypto_ctr_xor(UCHAR *plaintext, UCHAR *key, UCHAR *ciphertext) { -#ifndef NX_CRYPTO_DISABLE_UNALIGNED_ACCESS +#ifdef NX_CRYPTO_ENABLE_UNALIGNED_ACCESS UINT *p = (UINT *)plaintext; UINT *c = (UINT *)ciphertext; UINT *k = (UINT *)key; @@ -229,7 +232,7 @@ UINT i; { crypto_function(crypto_metadata, control_block, aes_output, block_size); _nx_crypto_ctr_xor(&input[i], aes_output, aes_output); - NX_CRYPTO_MEMCPY(&output[i], aes_output, length - i); + NX_CRYPTO_MEMCPY(&output[i], aes_output, length - i); } #ifdef NX_SECURE_KEY_CLEAR @@ -297,8 +300,8 @@ UCHAR *control_block = ctr_metadata -> nx_crypto_ctr_counter_block; */ NX_CRYPTO_MEMSET(control_block, 0x0, 16); control_block[15] = 1; - NX_CRYPTO_MEMCPY(&control_block[4], iv, 8); - NX_CRYPTO_MEMCPY(&control_block[0], nonce, 4); + NX_CRYPTO_MEMCPY(&control_block[4], iv, 8); + NX_CRYPTO_MEMCPY(&control_block[0], nonce, 4); return(NX_CRYPTO_SUCCESS); } diff --git a/crypto_libraries/src/nx_crypto_drbg.c b/crypto_libraries/src/nx_crypto_drbg.c index 940945c5..ccba1a74 100644 --- a/crypto_libraries/src/nx_crypto_drbg.c +++ b/crypto_libraries/src/nx_crypto_drbg.c @@ -105,7 +105,7 @@ INT i; /* FUNCTION RELEASE */ /* */ /* _nx_crypto_drbg_update PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -134,6 +134,9 @@ INT i; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), disabled */ +/* unaligned access by default,*/ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ NX_CRYPTO_KEEP static UINT _nx_crypto_drbg_update(NX_CRYPTO_DRBG *drbg_ptr, UCHAR *provided_data) @@ -201,7 +204,7 @@ VOID *handler = NX_CRYPTO_NULL; if (provided_data != NX_CRYPTO_NULL) { /* temp = temp xor provided_data. */ -#ifndef NX_CRYPTO_DISABLE_UNALIGNED_ACCESS +#ifdef NX_CRYPTO_ENABLE_UNALIGNED_ACCESS for (temp_len = 0; temp_len < (drbg_ptr -> nx_crypto_drbg_seedlen >> 2); temp_len++) { ((UINT*)temp)[temp_len] ^= ((UINT*)provided_data)[temp_len]; @@ -216,8 +219,8 @@ VOID *handler = NX_CRYPTO_NULL; key_len = crypto_method -> nx_crypto_key_size_in_bits >> 3; - NX_CRYPTO_MEMCPY(drbg_ptr -> nx_crypto_drbg_key, temp, key_len); - NX_CRYPTO_MEMCPY(drbg_ptr -> nx_crypto_drbg_v, &temp[key_len], NX_CRYPTO_DRBG_BLOCK_LENGTH_AES); + NX_CRYPTO_MEMCPY(drbg_ptr -> nx_crypto_drbg_key, temp, key_len); + NX_CRYPTO_MEMCPY(drbg_ptr -> nx_crypto_drbg_v, &temp[key_len], NX_CRYPTO_DRBG_BLOCK_LENGTH_AES); #ifdef NX_SECURE_KEY_CLEAR NX_CRYPTO_MEMSET(temp, 0, sizeof(temp)); @@ -232,7 +235,7 @@ VOID *handler = NX_CRYPTO_NULL; /* FUNCTION RELEASE */ /* */ /* _nx_crypto_drbg_instantiate PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -261,6 +264,9 @@ VOID *handler = NX_CRYPTO_NULL; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), disabled */ +/* unaligned access by default,*/ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ NX_CRYPTO_KEEP UINT _nx_crypto_drbg_instantiate(NX_CRYPTO_DRBG *drbg_ptr, @@ -301,9 +307,9 @@ UINT entropy_len; } df_input += entropy_len; - NX_CRYPTO_MEMCPY(df_input, nonce, nonce_len); + NX_CRYPTO_MEMCPY(df_input, nonce, nonce_len); df_input += nonce_len; - NX_CRYPTO_MEMCPY(df_input, personalization_string, personalization_string_len); + NX_CRYPTO_MEMCPY(df_input, personalization_string, personalization_string_len); /* seed_material = Block_Cipher_df (seed_material, seedlen). */ _nx_crypto_drbg_block_cipher_df(drbg_ptr, entropy_len + nonce_len + personalization_string_len, seed_material, drbg_ptr -> nx_crypto_drbg_seedlen); @@ -317,7 +323,7 @@ UINT entropy_len; if (personalization_string != NX_CRYPTO_NULL && personalization_string_len > 0) { - NX_CRYPTO_MEMCPY(seed_material, personalization_string, personalization_string_len); + NX_CRYPTO_MEMCPY(seed_material, personalization_string, personalization_string_len); } /* Ensure that the length of the personalization_string is exactly seedlen bits. */ @@ -335,7 +341,7 @@ UINT entropy_len; } /* seed_material = entropy_input xor personalization_string. */ -#ifndef NX_CRYPTO_DISABLE_UNALIGNED_ACCESS +#ifdef NX_CRYPTO_ENABLE_UNALIGNED_ACCESS for (i = 0; i < (drbg_ptr -> nx_crypto_drbg_seedlen >> 2); i++) { ((UINT*)seed_material)[i] ^= ((UINT*)drbg_ptr -> nx_crypto_drbg_buffer)[i]; @@ -369,7 +375,7 @@ UINT entropy_len; /* FUNCTION RELEASE */ /* */ /* _nx_crypto_drbg_reseed PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -398,6 +404,9 @@ UINT entropy_len; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), disabled */ +/* unaligned access by default,*/ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_crypto_drbg_reseed(NX_CRYPTO_DRBG *drbg_ptr, @@ -434,7 +443,7 @@ UINT status; } df_input += entropy_len; - NX_CRYPTO_MEMCPY(df_input, additional_input, additional_input_len); + NX_CRYPTO_MEMCPY(df_input, additional_input, additional_input_len); /* seed_material = Block_Cipher_df (seed_material, seedlen). */ _nx_crypto_drbg_block_cipher_df(drbg_ptr, entropy_len + additional_input_len, seed_material, drbg_ptr -> nx_crypto_drbg_seedlen); @@ -447,7 +456,7 @@ UINT status; } /* Ensure that the length of the additional_input is exactly seedlen bits. */ - NX_CRYPTO_MEMCPY(seed_material, additional_input, additional_input_len); + NX_CRYPTO_MEMCPY(seed_material, additional_input, additional_input_len); if (additional_input_len < drbg_ptr -> nx_crypto_drbg_seedlen) { NX_CRYPTO_MEMSET(&seed_material[additional_input_len], 0, @@ -462,7 +471,7 @@ UINT status; } /* seed_material = entropy_input xor additional_input. */ -#ifndef NX_CRYPTO_DISABLE_UNALIGNED_ACCESS +#ifdef NX_CRYPTO_ENABLE_UNALIGNED_ACCESS for (i = 0; i < (drbg_ptr -> nx_crypto_drbg_seedlen >> 2); i++) { ((UINT*)seed_material)[i] ^= ((UINT*)drbg_ptr -> nx_crypto_drbg_buffer)[i]; @@ -562,7 +571,7 @@ VOID *handler = NX_CRYPTO_NULL; if (additional_input_len > 0 && additional_input != NX_CRYPTO_NULL) { /* additional_input = Block_Cipher_df (additional_input, 256). */ - NX_CRYPTO_MEMCPY(drbg_ptr -> nx_crypto_drbg_buffer + NX_CRYPTO_DRBG_DF_INPUT_OFFSET, additional_input, additional_input_len); + NX_CRYPTO_MEMCPY(drbg_ptr -> nx_crypto_drbg_buffer + NX_CRYPTO_DRBG_DF_INPUT_OFFSET, additional_input, additional_input_len); _nx_crypto_drbg_block_cipher_df(drbg_ptr, additional_input_len, addition, drbg_ptr -> nx_crypto_drbg_seedlen); @@ -583,7 +592,7 @@ VOID *handler = NX_CRYPTO_NULL; else if (additional_input_len > 0 && additional_input != NX_CRYPTO_NULL) { /* Ensure that the length of the additional_input is exactly seedlen bits. */ - NX_CRYPTO_MEMCPY(addition, additional_input, additional_input_len); + NX_CRYPTO_MEMCPY(addition, additional_input, additional_input_len); if (additional_input_len < drbg_ptr -> nx_crypto_drbg_seedlen) { NX_CRYPTO_MEMSET(&addition[additional_input_len], 0, @@ -650,7 +659,7 @@ VOID *handler = NX_CRYPTO_NULL; if (output_length_in_byte - temp_len < NX_CRYPTO_DRBG_BLOCK_LENGTH_AES) { - NX_CRYPTO_MEMCPY(&output[temp_len], temp, output_length_in_byte - temp_len); + NX_CRYPTO_MEMCPY(&output[temp_len], temp, output_length_in_byte - temp_len); } temp_len += NX_CRYPTO_DRBG_BLOCK_LENGTH_AES; @@ -805,7 +814,7 @@ VOID *handler = NX_NULL; } - NX_CRYPTO_MEMCPY(&temp[temp_len], bcc_chain, NX_CRYPTO_DRBG_BLOCK_LENGTH); + NX_CRYPTO_MEMCPY(&temp[temp_len], bcc_chain, NX_CRYPTO_DRBG_BLOCK_LENGTH); temp_len += NX_CRYPTO_DRBG_BLOCK_LENGTH; iv[3]++; @@ -871,7 +880,7 @@ VOID *handler = NX_NULL; if (output_len - temp_len < NX_CRYPTO_DRBG_BLOCK_LENGTH_AES) { - NX_CRYPTO_MEMCPY(&output[temp_len], bcc_chain, output_len - temp_len); + NX_CRYPTO_MEMCPY(&output[temp_len], bcc_chain, output_len - temp_len); } temp_len += NX_CRYPTO_DRBG_BLOCK_LENGTH; diff --git a/crypto_libraries/src/nx_crypto_ec.c b/crypto_libraries/src/nx_crypto_ec.c index ebaf8e50..acf673f6 100644 --- a/crypto_libraries/src/nx_crypto_ec.c +++ b/crypto_libraries/src/nx_crypto_ec.c @@ -4137,3 +4137,136 @@ NX_CRYPTO_KEEP UINT _nx_crypto_method_ec_secp521r1_operation(UINT op, return(NX_CRYPTO_SUCCESS); } + + +/**************************************************************************/ +/* */ +/* FUNCTION RELEASE */ +/* */ +/* _nx_crypto_ec_validate_public_key PORTABLE C */ +/* 6.0.1 */ +/* AUTHOR */ +/* */ +/* Timothy Stapko, Microsoft Corporation */ +/* */ +/* DESCRIPTION */ +/* */ +/* This function validates the public key by ensuring that the point */ +/* is a valid point on the elliptic curve. This function supports prime*/ +/* field curves only. */ +/* */ +/* INPUT */ +/* */ +/* public_key Public key to be verified */ +/* chosen_curve Curve used by the key */ +/* partial Perform partial validation */ +/* scratch Pointer to scratch buffer. */ +/* This scratch buffer can be */ +/* reused after this function */ +/* returns. */ +/* */ +/* OUTPUT */ +/* */ +/* status Completion status */ +/* */ +/* CALLS */ +/* */ +/* _nx_crypto_huge_number_compare Compare huge number */ +/* */ +/* CALLED BY */ +/* */ +/* Application Code */ +/* */ +/* RELEASE HISTORY */ +/* */ +/* DATE NAME DESCRIPTION */ +/* */ +/* 06-30-2020 Timothy Stapko Initial Version 6.0.1 */ +/* */ +/**************************************************************************/ +#ifndef NX_CRYPTO_ECC_DISABLE_KEY_VALIDATION +UINT _nx_crypto_ec_validate_public_key(NX_CRYPTO_EC_POINT *public_key, + NX_CRYPTO_EC *chosen_curve, + UINT partial, + HN_UBASE *scratch) +{ +NX_CRYPTO_HUGE_NUMBER temp; +NX_CRYPTO_HUGE_NUMBER right; +UINT compare_value; +UINT buffer_size = chosen_curve -> nx_crypto_ec_n.nx_crypto_huge_buffer_size; +NX_CRYPTO_EC_POINT pt; +HN_UBASE *scratch2 = scratch; + + /* 1. Verify Q is not the point at infinity. */ + if(_nx_crypto_ec_point_is_infinite(public_key)) + { + return(NX_CRYPTO_INVALID_KEY); + } + + /* 2. Verify that xQ and yQ are integers in the interval [0, p−1]. + (Ensures that each coordinate of the public key has the unique correct representation of + an element in the underlying field.) */ + compare_value = _nx_crypto_huge_number_compare(&public_key -> nx_crypto_ec_point_x, &chosen_curve -> nx_crypto_ec_field.fp); + if (compare_value != NX_CRYPTO_HUGE_NUMBER_LESS) + { + return(NX_CRYPTO_INVALID_KEY); + } + + compare_value = _nx_crypto_huge_number_compare(&public_key -> nx_crypto_ec_point_y, &chosen_curve -> nx_crypto_ec_field.fp); + if (compare_value != NX_CRYPTO_HUGE_NUMBER_LESS) + { + return(NX_CRYPTO_INVALID_KEY); + } + + if (public_key -> nx_crypto_ec_point_x.nx_crypto_huge_number_is_negative || + public_key -> nx_crypto_ec_point_y.nx_crypto_huge_number_is_negative) + { + return(NX_CRYPTO_INVALID_KEY); + } + + /* 3. Verify that (yQ)^2 = (xQ)^3 + axQ + b in GF(p) , where the arithmetic is + performed modulo p. + (xQ)^3 + axQ + b = ((xQ)^2 + a)xQ + b + (This step is to ensure that the public key is on the correct elliptic curve.) + */ + NX_CRYPTO_HUGE_NUMBER_INITIALIZE(&temp, scratch2, buffer_size * 2); + NX_CRYPTO_HUGE_NUMBER_INITIALIZE(&right, scratch2, buffer_size * 2); + + _nx_crypto_huge_number_multiply(&public_key -> nx_crypto_ec_point_x, &public_key -> nx_crypto_ec_point_x, &temp); + _nx_crypto_huge_number_modulus(&temp, &chosen_curve -> nx_crypto_ec_field.fp); + _nx_crypto_huge_number_add_unsigned(&temp, &chosen_curve -> nx_crypto_ec_a); + _nx_crypto_huge_number_modulus(&temp, &chosen_curve -> nx_crypto_ec_field.fp); + + _nx_crypto_huge_number_multiply(&temp, &public_key -> nx_crypto_ec_point_x, &right); + _nx_crypto_huge_number_modulus(&right, &chosen_curve -> nx_crypto_ec_field.fp); + + _nx_crypto_huge_number_add_unsigned(&right, &chosen_curve -> nx_crypto_ec_b); + _nx_crypto_huge_number_modulus(&right, &chosen_curve -> nx_crypto_ec_field.fp); + + _nx_crypto_huge_number_multiply(&public_key -> nx_crypto_ec_point_y, &public_key -> nx_crypto_ec_point_y, &temp); + _nx_crypto_huge_number_modulus(&temp, &chosen_curve -> nx_crypto_ec_field.fp); + + compare_value = _nx_crypto_huge_number_compare(&temp, &right); + if (compare_value != NX_CRYPTO_HUGE_NUMBER_EQUAL) + { + return(NX_CRYPTO_INVALID_KEY); + } + + /* 4. Verify that nQ = Ø. + (This step is to ensure that the public key has the correct order. Along with the + verification in step 1, ensures that the public key is in the correct range in the correct EC + subgroup; that is, it is in the correct EC subgroup and is not the identity element Ø.) + */ + if (!partial) + { + NX_CRYPTO_EC_POINT_INITIALIZE(&pt, NX_CRYPTO_EC_POINT_AFFINE, scratch, buffer_size); + chosen_curve -> nx_crypto_ec_multiple(chosen_curve, public_key, &chosen_curve -> nx_crypto_ec_n, &pt, scratch); + if (!_nx_crypto_ec_point_is_infinite(&pt)) + { + return(NX_CRYPTO_INVALID_KEY); + } + } + + return(NX_CRYPTO_SUCCESS); +} +#endif /* NX_CRYPTO_ECC_DISABLE_KEY_VALIDATION */ diff --git a/crypto_libraries/src/nx_crypto_ecdh.c b/crypto_libraries/src/nx_crypto_ecdh.c index 73f005f2..d0f1d3b8 100644 --- a/crypto_libraries/src/nx_crypto_ecdh.c +++ b/crypto_libraries/src/nx_crypto_ecdh.c @@ -305,7 +305,7 @@ NX_CRYPTO_EC_POINT public_key; /* FUNCTION RELEASE */ /* */ /* _nx_crypto_ecdh_compute_secret PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -349,6 +349,9 @@ NX_CRYPTO_EC_POINT public_key; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), and */ +/* added public key validation,*/ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ NX_CRYPTO_KEEP UINT _nx_crypto_ecdh_compute_secret(NX_CRYPTO_ECDH *ecdh_ptr, @@ -403,6 +406,14 @@ NX_CRYPTO_EC_POINT public_key, shared_secret; return(status); } +#ifndef NX_CRYPTO_ECC_DISABLE_KEY_VALIDATION + status = _nx_crypto_ec_validate_public_key(&public_key, curve, NX_CRYPTO_TRUE, scratch_buf_ptr); + if (status != NX_CRYPTO_SUCCESS) + { + return(status); + } +#endif /* NX_CRYPTO_ECC_DISABLE_KEY_VALIDATION */ + /* Private key buffer - note that no scratch is required for the private key, but we set it in case it is needed in the future. */ private_key.nx_crypto_huge_number_data = (HN_UBASE *)ecdh_ptr -> nx_crypto_ecdh_private_key_buffer; diff --git a/crypto_libraries/src/nx_crypto_ecdsa.c b/crypto_libraries/src/nx_crypto_ecdsa.c index 30fde21c..e70d2282 100644 --- a/crypto_libraries/src/nx_crypto_ecdsa.c +++ b/crypto_libraries/src/nx_crypto_ecdsa.c @@ -265,7 +265,7 @@ UCHAR *signature_s; /* FUNCTION RELEASE */ /* */ /* _nx_crypto_ecdsa_verify PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -304,6 +304,10 @@ UCHAR *signature_s; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), and */ +/* fixed input validation, */ +/* added public key validation,*/ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ NX_CRYPTO_KEEP UINT _nx_crypto_ecdsa_verify(NX_CRYPTO_EC *curve, UCHAR *hash, UINT hash_length, @@ -375,6 +379,14 @@ UINT buffer_size = curve -> nx_crypto_ec_n.nx_crypto_huge_buffe return(status); } +#ifndef NX_CRYPTO_ECC_DISABLE_KEY_VALIDATION + status = _nx_crypto_ec_validate_public_key(&pubkey, curve, NX_CRYPTO_FALSE, scratch); + if (status != NX_CRYPTO_SUCCESS) + { + return(status); + } +#endif /* NX_CRYPTO_ECC_DISABLE_KEY_VALIDATION */ + if (signature_length < (signature[1] + 2u)) { return(NX_CRYPTO_SIZE_ERROR); @@ -401,6 +413,22 @@ UINT buffer_size = curve -> nx_crypto_ec_n.nx_crypto_huge_buffe return(status); } + /* r and s must be in the range [1..n-1] */ + if(_nx_crypto_huge_number_is_zero(&r) || _nx_crypto_huge_number_is_zero(&s)) + { + return(NX_CRYPTO_NOT_SUCCESSFUL); + } + + if(NX_CRYPTO_HUGE_NUMBER_LESS != _nx_crypto_huge_number_compare_unsigned(&r, &curve -> nx_crypto_ec_n)) + { + return(NX_CRYPTO_NOT_SUCCESSFUL); + } + + if(NX_CRYPTO_HUGE_NUMBER_LESS != _nx_crypto_huge_number_compare_unsigned(&s, &curve -> nx_crypto_ec_n)) + { + return(NX_CRYPTO_NOT_SUCCESSFUL); + } + /* Truncate the hash data to the size of group order. */ if (hash_length > buffer_size) { diff --git a/crypto_libraries/src/nx_crypto_ecjpake.c b/crypto_libraries/src/nx_crypto_ecjpake.c index 14e57539..80efc98b 100644 --- a/crypto_libraries/src/nx_crypto_ecjpake.c +++ b/crypto_libraries/src/nx_crypto_ecjpake.c @@ -1552,7 +1552,7 @@ UINT status; } - NX_CRYPTO_MEMCPY(key_encryption_key, buffer, 16); + NX_CRYPTO_MEMCPY(key_encryption_key, buffer, 16); if (hash_method -> nx_crypto_cleanup) { diff --git a/crypto_libraries/src/nx_crypto_gcm.c b/crypto_libraries/src/nx_crypto_gcm.c index b0160bfc..6dd3d071 100644 --- a/crypto_libraries/src/nx_crypto_gcm.c +++ b/crypto_libraries/src/nx_crypto_gcm.c @@ -28,7 +28,7 @@ /* FUNCTION RELEASE */ /* */ /* _nx_crypto_gcm_xor PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -62,11 +62,14 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), disabled */ +/* unaligned access by default,*/ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ NX_CRYPTO_KEEP static VOID _nx_crypto_gcm_xor(UCHAR *plaintext, UCHAR *key, UCHAR *ciphertext) { -#ifndef NX_CRYPTO_DISABLE_UNALIGNED_ACCESS +#ifdef NX_CRYPTO_ENABLE_UNALIGNED_ACCESS UINT *p = (UINT *)plaintext; UINT *c = (UINT *)ciphertext; UINT *k = (UINT *)key; @@ -200,7 +203,7 @@ UCHAR lsb; UCHAR mask; NX_CRYPTO_MEMSET(output, 0, NX_CRYPTO_GCM_BLOCK_SIZE); - NX_CRYPTO_MEMCPY(v, y, NX_CRYPTO_GCM_BLOCK_SIZE); + NX_CRYPTO_MEMCPY(v, y, NX_CRYPTO_GCM_BLOCK_SIZE); mask = 0x80; for (i = 0; i < NX_CRYPTO_GCM_BLOCK_SIZE_BITS; i++) @@ -301,7 +304,7 @@ UINT i, n; /* Pad the block with zeros when the input length is not multiple of the block size. */ - NX_CRYPTO_MEMCPY(tmp_block, input, input_length); + NX_CRYPTO_MEMCPY(tmp_block, input, input_length); NX_CRYPTO_MEMSET(&tmp_block[input_length], 0, sizeof(tmp_block) - input_length); _nx_crypto_gcm_xor(output, tmp_block, tmp_block); _nx_crypto_gcm_multi(tmp_block, hkey, output); @@ -385,7 +388,7 @@ UINT i, n; /* Perform XOR operation on local buffer when remaining input length is smaller than block size. */ _nx_crypto_gcm_xor(input, aes_output, aes_output); - NX_CRYPTO_MEMCPY(output, aes_output, length); + NX_CRYPTO_MEMCPY(output, aes_output, length); } } @@ -468,7 +471,7 @@ UCHAR iv_len; /* When the length of IV is 12 then 1 is appended to IV to form j0. */ /* j0 in increased before GCTR. */ - NX_CRYPTO_MEMCPY(j0, iv, iv_len); + NX_CRYPTO_MEMCPY(j0, iv, iv_len); j0[12] = 0; j0[13] = 0; j0[14] = 0; @@ -493,7 +496,7 @@ UCHAR iv_len; _nx_crypto_gcm_ghash_update(hkey, additional_data, additional_len, s); /* Initial counter block for GCTR is j0 + 1. */ - NX_CRYPTO_MEMCPY(counter, j0, NX_CRYPTO_GCM_BLOCK_SIZE); + NX_CRYPTO_MEMCPY(counter, j0, NX_CRYPTO_GCM_BLOCK_SIZE); _nx_crypto_gcm_inc32(counter); gcm_metadata -> nx_crypto_gcm_additional_data_len = additional_len; @@ -661,7 +664,7 @@ UINT length; _nx_crypto_gcm_gctr(crypto_metadata, crypto_function, s, s, NX_CRYPTO_GCM_BLOCK_SIZE, j0); /* Append authentication tag to the end of the cipher text. */ - NX_CRYPTO_MEMCPY(output, s, icv_len); + NX_CRYPTO_MEMCPY(output, s, icv_len); #ifdef NX_SECURE_KEY_CLEAR NX_CRYPTO_MEMSET(tmp_block, 0, sizeof(tmp_block)); diff --git a/crypto_libraries/src/nx_crypto_hkdf.c b/crypto_libraries/src/nx_crypto_hkdf.c index a3d17937..292f673a 100644 --- a/crypto_libraries/src/nx_crypto_hkdf.c +++ b/crypto_libraries/src/nx_crypto_hkdf.c @@ -190,7 +190,7 @@ UINT status; /* FUNCTION RELEASE */ /* */ /* _nx_crypto_method_hkdf_operation PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -235,6 +235,9 @@ UINT status; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), improved */ +/* buffer length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ NX_CRYPTO_KEEP UINT _nx_crypto_method_hkdf_operation(UINT op, /* Encrypt, Decrypt, Authenticate */ @@ -307,8 +310,13 @@ UINT status; return(NX_CRYPTO_POINTER_ERROR); } + if ((key_size_in_bits >> 3) > sizeof(hkdf->nx_crypto_hkdf_prk)) + { + return(NX_CRYPTO_SIZE_ERROR); + } + /* Set the PRK and return. */ - NX_CRYPTO_MEMCPY(hkdf->nx_crypto_hkdf_prk, key, (key_size_in_bits >> 3)); + NX_CRYPTO_MEMCPY(hkdf->nx_crypto_hkdf_prk, key, (key_size_in_bits >> 3)); hkdf->nx_crypto_hkdf_prk_size = (key_size_in_bits >> 3); break; @@ -338,8 +346,13 @@ UINT status; if(status == NX_CRYPTO_SUCCESS) { + if (output_length_in_byte < hkdf->nx_crypto_hkdf_prk_size) + { + return(NX_CRYPTO_SIZE_ERROR); + } + /* Copy the PRK into output. */ - NX_CRYPTO_MEMCPY(output, hkdf->nx_crypto_hkdf_prk, hkdf->nx_crypto_hkdf_prk_size); + NX_CRYPTO_MEMCPY(output, hkdf->nx_crypto_hkdf_prk, hkdf->nx_crypto_hkdf_prk_size); } break; @@ -515,7 +528,7 @@ NX_CRYPTO_METHOD *hmac_method = hkdf -> nx_crypto_hmac_method; /* FUNCTION RELEASE */ /* */ /* _nx_crypto_method_hkdf_expand PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -547,6 +560,9 @@ NX_CRYPTO_METHOD *hmac_method = hkdf -> nx_crypto_hmac_method; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), improved */ +/* buffer length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_crypto_hkdf_expand(NX_CRYPTO_HKDF *hkdf, UCHAR *output, UINT desired_length) @@ -644,8 +660,13 @@ NX_CRYPTO_METHOD *hmac_method = hkdf -> nx_crypto_hmac_method; * to N_count to get the full amount of data. */ for (i = 1; i < N_count + 1; ++i) { + if ((T_len + info_len + 1) > temp_T_size) + { + return(NX_CRYPTO_SIZE_ERROR); + } + /* Concatenate T(i-1) (in temp_T after the hash above), info, and counter octet to feed into digest. */ - NX_CRYPTO_MEMCPY(&temp_T[T_len], info, info_len); + NX_CRYPTO_MEMCPY(&temp_T[T_len], info, info_len); /* Concatenate counter octet. */ temp_T[T_len + info_len] = (UCHAR)(i & 0xFF); @@ -715,7 +736,7 @@ NX_CRYPTO_METHOD *hmac_method = hkdf -> nx_crypto_hmac_method; } /* Copy T(i) into output. */ - NX_CRYPTO_MEMCPY(&output[offset], temp_T, output_len); + NX_CRYPTO_MEMCPY(&output[offset], temp_T, output_len); } diff --git a/crypto_libraries/src/nx_crypto_hmac.c b/crypto_libraries/src/nx_crypto_hmac.c index b7980aba..8e31f7f0 100644 --- a/crypto_libraries/src/nx_crypto_hmac.c +++ b/crypto_libraries/src/nx_crypto_hmac.c @@ -168,9 +168,9 @@ UINT i; NX_CRYPTO_MEMSET(hmac_metadata -> k_opad, 0, hmac_metadata -> block_size); - NX_CRYPTO_MEMCPY(hmac_metadata -> k_ipad, key_ptr, key_length); + NX_CRYPTO_MEMCPY(hmac_metadata -> k_ipad, key_ptr, key_length); - NX_CRYPTO_MEMCPY(hmac_metadata -> k_opad, key_ptr, key_length); + NX_CRYPTO_MEMCPY(hmac_metadata -> k_opad, key_ptr, key_length); /* XOR key with ipad and opad values. */ @@ -302,7 +302,7 @@ UCHAR icv_ptr[64]; hmac_metadata -> crypto_digest_calculate(hmac_metadata -> context, icv_ptr, hmac_metadata -> algorithm); - NX_CRYPTO_MEMCPY(digest_ptr, icv_ptr, (digest_length > hmac_metadata -> output_length ? hmac_metadata -> output_length : digest_length)); + NX_CRYPTO_MEMCPY(digest_ptr, icv_ptr, (digest_length > hmac_metadata -> output_length ? hmac_metadata -> output_length : digest_length)); #ifdef NX_SECURE_KEY_CLEAR NX_CRYPTO_MEMSET(icv_ptr, 0, sizeof(icv_ptr)); diff --git a/crypto_libraries/src/nx_crypto_huge_number.c b/crypto_libraries/src/nx_crypto_huge_number.c index ad0fd604..061251e9 100644 --- a/crypto_libraries/src/nx_crypto_huge_number.c +++ b/crypto_libraries/src/nx_crypto_huge_number.c @@ -2190,7 +2190,7 @@ UINT buffer_size; /* FUNCTION RELEASE */ /* */ /* _nx_crypto_huge_number_inverse_modulus PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -2241,6 +2241,9 @@ UINT buffer_size; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), and */ +/* fixed input validation, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ NX_CRYPTO_KEEP UINT _nx_crypto_huge_number_inverse_modulus(NX_CRYPTO_HUGE_NUMBER *a, @@ -2259,6 +2262,13 @@ UINT buffer_size; return(NX_CRYPTO_NOT_SUCCESSFUL); } + if(_nx_crypto_huge_number_is_zero(a)) + { + + /* zero is not invertible */ + return(NX_CRYPTO_NOT_SUCCESSFUL); + } + if (m -> nx_crypto_huge_number_size > a -> nx_crypto_huge_number_size) { buffer_size = (m -> nx_crypto_huge_number_size + 1) << HN_SIZE_SHIFT; diff --git a/crypto_libraries/src/nx_crypto_md5.c b/crypto_libraries/src/nx_crypto_md5.c index 5585d28a..f1758c65 100644 --- a/crypto_libraries/src/nx_crypto_md5.c +++ b/crypto_libraries/src/nx_crypto_md5.c @@ -246,7 +246,7 @@ ULONG needed_fill_bytes; /* Copy the appropriate portion of the input buffer into the internal buffer of the context. */ - NX_CRYPTO_MEMCPY((void *)&(context -> nx_md5_buffer[current_bytes]), (void *)input_ptr, needed_fill_bytes); + NX_CRYPTO_MEMCPY((void *)&(context -> nx_md5_buffer[current_bytes]), (void *)input_ptr, needed_fill_bytes); /* Process the 64-byte (512 bit) buffer. */ _nx_crypto_md5_process_buffer(context, context -> nx_md5_buffer); @@ -277,7 +277,7 @@ ULONG needed_fill_bytes; /* Save the remaining bytes in the internal buffer after any remaining bytes that it is processed later. */ - NX_CRYPTO_MEMCPY((void *)&(context -> nx_md5_buffer[current_bytes]), (void *)input_ptr, input_length); + NX_CRYPTO_MEMCPY((void *)&(context -> nx_md5_buffer[current_bytes]), (void *)input_ptr, input_length); } /* Return success. */ diff --git a/crypto_libraries/src/nx_crypto_method_self_test_drbg.c b/crypto_libraries/src/nx_crypto_method_self_test_drbg.c index c5aeff04..258bf7c4 100644 --- a/crypto_libraries/src/nx_crypto_method_self_test_drbg.c +++ b/crypto_libraries/src/nx_crypto_method_self_test_drbg.c @@ -188,17 +188,17 @@ NX_CRYPTO_KEEP static UINT drbg_test_get_entropy_pr(UCHAR *entropy, UINT *entrop if (drbg_test_entropy_count_pr == 0) { - NX_CRYPTO_MEMCPY(entropy, entropy_input_aes128, entropy_input_len_aes128); + NX_CRYPTO_MEMCPY(entropy, entropy_input_aes128, entropy_input_len_aes128); *entropy_len = entropy_input_len_aes128; } else if (drbg_test_entropy_count_pr == 1) { - NX_CRYPTO_MEMCPY(entropy, entropy_input_pr_0_aes128, entropy_input_len_aes128); + NX_CRYPTO_MEMCPY(entropy, entropy_input_pr_0_aes128, entropy_input_len_aes128); *entropy_len = entropy_input_len_aes128; } else if (drbg_test_entropy_count_pr == 2) { - NX_CRYPTO_MEMCPY(entropy, entropy_input_pr_1_aes128, entropy_input_len_aes128); + NX_CRYPTO_MEMCPY(entropy, entropy_input_pr_1_aes128, entropy_input_len_aes128); *entropy_len = entropy_input_len_aes128; } else @@ -266,12 +266,12 @@ NX_CRYPTO_KEEP static UINT drbg_test_get_entropy_npr(UCHAR *entropy, UINT *entro if (drbg_test_entropy_count_npr == 0) { - NX_CRYPTO_MEMCPY(entropy, entropy_input_npr_aes128, entropy_input_len_npr_aes128); + NX_CRYPTO_MEMCPY(entropy, entropy_input_npr_aes128, entropy_input_len_npr_aes128); *entropy_len = entropy_input_len_npr_aes128; } else if (drbg_test_entropy_count_npr == 1) { - NX_CRYPTO_MEMCPY(entropy, entropy_input_reseed_npr_aes128, entropy_input_len_npr_aes128); + NX_CRYPTO_MEMCPY(entropy, entropy_input_reseed_npr_aes128, entropy_input_len_npr_aes128); *entropy_len = entropy_input_len_npr_aes128; } else diff --git a/crypto_libraries/src/nx_crypto_phash.c b/crypto_libraries/src/nx_crypto_phash.c index 0a0681c7..a080fb5f 100644 --- a/crypto_libraries/src/nx_crypto_phash.c +++ b/crypto_libraries/src/nx_crypto_phash.c @@ -28,7 +28,7 @@ /* FUNCTION RELEASE */ /* */ /* _nx_crypto_phash PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -60,6 +60,9 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), improved */ +/* buffer length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ NX_CRYPTO_KEEP UINT _nx_crypto_phash(NX_CRYPTO_PHASH *phash, UCHAR *output, UINT desired_length) @@ -117,9 +120,14 @@ NX_CRYPTO_METHOD *hash_method = phash -> nx_crypto_hmac_method; return(NX_CRYPTO_INVALID_PARAMETER); } + if (seed_len > temp_A_size) + { + return(NX_CRYPTO_SIZE_ERROR); + } + /* Assign the seed as A(0). */ NX_CRYPTO_MEMSET(temp_A, 0, temp_A_size); - NX_CRYPTO_MEMCPY(temp_A, seed, seed_len); + NX_CRYPTO_MEMCPY(temp_A, seed, seed_len); A_len = phash -> nx_crypto_phash_seed_length; remaining_len = desired_length; @@ -164,8 +172,13 @@ NX_CRYPTO_METHOD *hash_method = phash -> nx_crypto_hmac_method; /* Updated the length of A(i) */ A_len = hash_size; + if ((A_len + seed_len) > temp_A_size) + { + return(NX_CRYPTO_SIZE_ERROR); + } + /* Concatenate A[i] and seed to feed into digest. */ - NX_CRYPTO_MEMCPY(&temp_A[A_len], seed, seed_len); + NX_CRYPTO_MEMCPY(&temp_A[A_len], seed, seed_len); /* Output block is the size of the digest unless the remaining desired length is smaller than the digest length. */ diff --git a/crypto_libraries/src/nx_crypto_pkcs1_v1.5.c b/crypto_libraries/src/nx_crypto_pkcs1_v1.5.c index 1039aa7d..cb8e14dd 100644 --- a/crypto_libraries/src/nx_crypto_pkcs1_v1.5.c +++ b/crypto_libraries/src/nx_crypto_pkcs1_v1.5.c @@ -306,7 +306,7 @@ UINT status; /* FUNCTION RELEASE */ /* */ /* _nx_crypto_pkcs1_v1_5_encode PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -335,6 +335,9 @@ UINT status; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), improved */ +/* buffer length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ NX_CRYPTO_KEEP UINT _nx_crypto_pkcs1_v1_5_encode(UCHAR *input, UINT input_length, @@ -406,6 +409,10 @@ UINT status; /* Calculate our final signature length for later offset calculations. */ signature_length = der_encoding_length + hash_length; /* DER encoding size + hash size = plaintext encoded signature length */ + if (signature_length + 1 > expected_output_length) + { + return(NX_CRYPTO_SIZE_ERROR); + } output[expected_output_length - signature_length - 1] = 0; /* Get a working pointer into the padded signature buffer. All PKCS-1 encoded data @@ -413,7 +420,7 @@ UINT status; working_ptr = &output[expected_output_length - signature_length]; /* Copy in the DER encoding. */ - NX_CRYPTO_MEMCPY(working_ptr, der_encoding, der_encoding_length); + NX_CRYPTO_MEMCPY(working_ptr, der_encoding, der_encoding_length); /* Move the working pointer to the end of the DER encoding. */ working_ptr += der_encoding_length; diff --git a/crypto_libraries/src/nx_crypto_sha1.c b/crypto_libraries/src/nx_crypto_sha1.c index 17238a1f..011980cb 100644 --- a/crypto_libraries/src/nx_crypto_sha1.c +++ b/crypto_libraries/src/nx_crypto_sha1.c @@ -228,7 +228,7 @@ ULONG needed_fill_bytes; /* Copy the appropriate portion of the input buffer into the internal buffer of the context. */ - NX_CRYPTO_MEMCPY((void *)&(context -> nx_sha1_buffer[current_bytes]), (void *)input_ptr, needed_fill_bytes); + NX_CRYPTO_MEMCPY((void *)&(context -> nx_sha1_buffer[current_bytes]), (void *)input_ptr, needed_fill_bytes); /* Process the 64-byte (512 bit) buffer. */ _nx_crypto_sha1_process_buffer(context, context -> nx_sha1_buffer); @@ -259,7 +259,7 @@ ULONG needed_fill_bytes; /* Save the remaining bytes in the internal buffer after any remaining bytes that it is processed later. */ - NX_CRYPTO_MEMCPY((void *)&(context -> nx_sha1_buffer[current_bytes]), (void *)input_ptr, input_length); + NX_CRYPTO_MEMCPY((void *)&(context -> nx_sha1_buffer[current_bytes]), (void *)input_ptr, input_length); } /* Return success. */ diff --git a/crypto_libraries/src/nx_crypto_sha2.c b/crypto_libraries/src/nx_crypto_sha2.c index 33680fbc..932cefc1 100644 --- a/crypto_libraries/src/nx_crypto_sha2.c +++ b/crypto_libraries/src/nx_crypto_sha2.c @@ -223,7 +223,7 @@ ULONG needed_fill_bytes; /* Copy the appropriate portion of the input buffer into the internal buffer of the context. */ - NX_CRYPTO_MEMCPY((void *)&(context -> nx_sha256_buffer[current_bytes]), (void *)input_ptr, needed_fill_bytes); + NX_CRYPTO_MEMCPY((void *)&(context -> nx_sha256_buffer[current_bytes]), (void *)input_ptr, needed_fill_bytes); /* Process the 64-byte (512 bit) buffer. */ _nx_crypto_sha256_process_buffer(context, context -> nx_sha256_buffer); @@ -253,7 +253,7 @@ ULONG needed_fill_bytes; { /* Save the remaining bytes in the internal buffer after any remaining bytes so that it is processed later. */ - NX_CRYPTO_MEMCPY((void *)&(context -> nx_sha256_buffer[current_bytes]), (void *)input_ptr, input_length); + NX_CRYPTO_MEMCPY((void *)&(context -> nx_sha256_buffer[current_bytes]), (void *)input_ptr, input_length); } /* Return success. */ diff --git a/crypto_libraries/src/nx_crypto_sha5.c b/crypto_libraries/src/nx_crypto_sha5.c index e34b7288..85387104 100644 --- a/crypto_libraries/src/nx_crypto_sha5.c +++ b/crypto_libraries/src/nx_crypto_sha5.c @@ -274,7 +274,7 @@ ULONG64 needed_fill_bytes; /* Copy the appropriate portion of the input buffer into the internal buffer of the context. */ - NX_CRYPTO_MEMCPY((void *)&(context -> nx_sha512_buffer[current_bytes]), (void *)input_ptr, (UINT)needed_fill_bytes); + NX_CRYPTO_MEMCPY((void *)&(context -> nx_sha512_buffer[current_bytes]), (void *)input_ptr, (UINT)needed_fill_bytes); /* Process the 128-byte (1024 bit) buffer. */ _nx_crypto_sha512_process_buffer(context, context -> nx_sha512_buffer); @@ -304,7 +304,7 @@ ULONG64 needed_fill_bytes; { /* Save the remaining bytes in the internal buffer after any remaining bytes so that it is processed later. */ - NX_CRYPTO_MEMCPY((void *)&(context -> nx_sha512_buffer[current_bytes]), (void *)input_ptr, input_length); + NX_CRYPTO_MEMCPY((void *)&(context -> nx_sha512_buffer[current_bytes]), (void *)input_ptr, input_length); } /* Return success. */ diff --git a/crypto_libraries/src/nx_crypto_tls_prf_1.c b/crypto_libraries/src/nx_crypto_tls_prf_1.c index 147b063d..2cb2bb65 100644 --- a/crypto_libraries/src/nx_crypto_tls_prf_1.c +++ b/crypto_libraries/src/nx_crypto_tls_prf_1.c @@ -168,7 +168,7 @@ NX_CRYPTO_KEEP UINT _nx_crypto_method_prf_1_cleanup(VOID *crypto_metadata) /* FUNCTION RELEASE */ /* */ /* _nx_crypto_method_prf_1_operation PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -213,6 +213,9 @@ NX_CRYPTO_KEEP UINT _nx_crypto_method_prf_1_cleanup(VOID *crypto_metadata) /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), improved */ +/* buffer length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ NX_CRYPTO_KEEP UINT _nx_crypto_method_prf_1_operation(UINT op, /* Encrypt, Decrypt, Authenticate */ @@ -265,10 +268,14 @@ NX_CRYPTO_PHASH *phash; /* Install the label_seed_buffer to the phash structure as the buffer of phash seed. */ phash -> nx_crypto_phash_seed = prf -> nx_secure_tls_prf_label_seed_buffer; + if ((key_size_in_bits + input_length_in_byte) > sizeof(prf -> nx_secure_tls_prf_label_seed_buffer)) + { + return(NX_CRYPTO_SIZE_ERROR); + } /* Concatenate label and seed. */ - NX_CRYPTO_MEMCPY(phash -> nx_crypto_phash_seed, key, key_size_in_bits); - NX_CRYPTO_MEMCPY(&phash -> nx_crypto_phash_seed[key_size_in_bits], input, input_length_in_byte); + NX_CRYPTO_MEMCPY(phash -> nx_crypto_phash_seed, key, key_size_in_bits); + NX_CRYPTO_MEMCPY(&phash -> nx_crypto_phash_seed[key_size_in_bits], input, input_length_in_byte); phash -> nx_crypto_phash_seed_length = key_size_in_bits + input_length_in_byte; /* Install the temp_A_buffer to the phash structure. */ diff --git a/crypto_libraries/src/nx_crypto_tls_prf_sha256.c b/crypto_libraries/src/nx_crypto_tls_prf_sha256.c index 225ebaea..352df131 100644 --- a/crypto_libraries/src/nx_crypto_tls_prf_sha256.c +++ b/crypto_libraries/src/nx_crypto_tls_prf_sha256.c @@ -168,7 +168,7 @@ NX_CRYPTO_KEEP UINT _nx_crypto_method_prf_sha_256_cleanup(VOID *crypto_metadata /* FUNCTION RELEASE */ /* */ /* _nx_crypto_method_prf_sha_256_operation PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -213,6 +213,9 @@ NX_CRYPTO_KEEP UINT _nx_crypto_method_prf_sha_256_cleanup(VOID *crypto_metadata /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), improved */ +/* buffer length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ NX_CRYPTO_KEEP UINT _nx_crypto_method_prf_sha_256_operation(UINT op, /* Encrypt, Decrypt, Authenticate */ @@ -264,10 +267,14 @@ NX_CRYPTO_PHASH *phash; /* Install the label_seed_buffer to the phash structure as the buffer of phash seed. */ phash -> nx_crypto_phash_seed = prf -> nx_secure_tls_prf_label_seed_buffer; + if ((key_size_in_bits + input_length_in_byte) > sizeof(prf -> nx_secure_tls_prf_label_seed_buffer)) + { + return(NX_CRYPTO_SIZE_ERROR); + } /* Concatenate label and seed. */ - NX_CRYPTO_MEMCPY(phash -> nx_crypto_phash_seed, key, key_size_in_bits); - NX_CRYPTO_MEMCPY(&phash -> nx_crypto_phash_seed[key_size_in_bits], input, input_length_in_byte); + NX_CRYPTO_MEMCPY(phash -> nx_crypto_phash_seed, key, key_size_in_bits); + NX_CRYPTO_MEMCPY(&phash -> nx_crypto_phash_seed[key_size_in_bits], input, input_length_in_byte); phash -> nx_crypto_phash_seed_length = key_size_in_bits + input_length_in_byte; /* Install the temp_A_buffer to the phash structure. */ diff --git a/crypto_libraries/src/nx_crypto_tls_prf_sha384.c b/crypto_libraries/src/nx_crypto_tls_prf_sha384.c index 02d93b8b..83dfbeeb 100644 --- a/crypto_libraries/src/nx_crypto_tls_prf_sha384.c +++ b/crypto_libraries/src/nx_crypto_tls_prf_sha384.c @@ -169,7 +169,7 @@ NX_CRYPTO_KEEP UINT _nx_crypto_method_prf_sha384_cleanup(VOID *crypto_metadata) /* FUNCTION RELEASE */ /* */ /* _nx_crypto_method_prf_sha384_operation PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -213,6 +213,9 @@ NX_CRYPTO_KEEP UINT _nx_crypto_method_prf_sha384_cleanup(VOID *crypto_metadata) /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), improved */ +/* buffer length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ NX_CRYPTO_KEEP UINT _nx_crypto_method_prf_sha384_operation(UINT op, /* Encrypt, Decrypt, Authenticate */ @@ -264,10 +267,14 @@ NX_CRYPTO_PHASH *phash; /* Install the label_seed_buffer to the phash structure as the buffer of phash seed. */ phash -> nx_crypto_phash_seed = prf -> nx_secure_tls_prf_label_seed_buffer; + if ((key_size_in_bits + input_length_in_byte) > sizeof(prf -> nx_secure_tls_prf_label_seed_buffer)) + { + return(NX_CRYPTO_SIZE_ERROR); + } /* Concatenate label and seed. */ - NX_CRYPTO_MEMCPY(phash -> nx_crypto_phash_seed, key, key_size_in_bits); - NX_CRYPTO_MEMCPY(&phash -> nx_crypto_phash_seed[key_size_in_bits], input, input_length_in_byte); + NX_CRYPTO_MEMCPY(phash -> nx_crypto_phash_seed, key, key_size_in_bits); + NX_CRYPTO_MEMCPY(&phash -> nx_crypto_phash_seed[key_size_in_bits], input, input_length_in_byte); phash -> nx_crypto_phash_seed_length = key_size_in_bits + input_length_in_byte; /* Install the temp_A_buffer to the phash structure. */ diff --git a/crypto_libraries/src/nx_crypto_tls_prf_sha512.c b/crypto_libraries/src/nx_crypto_tls_prf_sha512.c index f7d89b5c..de15c24d 100644 --- a/crypto_libraries/src/nx_crypto_tls_prf_sha512.c +++ b/crypto_libraries/src/nx_crypto_tls_prf_sha512.c @@ -169,7 +169,7 @@ NX_CRYPTO_KEEP UINT _nx_crypto_method_prf_sha512_cleanup(VOID *crypto_metadata) /* FUNCTION RELEASE */ /* */ /* _nx_crypto_method_prf_sha512_operation PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -213,6 +213,9 @@ NX_CRYPTO_KEEP UINT _nx_crypto_method_prf_sha512_cleanup(VOID *crypto_metadata) /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), improved */ +/* buffer length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ NX_CRYPTO_KEEP UINT _nx_crypto_method_prf_sha512_operation(UINT op, /* Encrypt, Decrypt, Authenticate */ @@ -264,10 +267,14 @@ NX_CRYPTO_PHASH *phash; /* Install the label_seed_buffer to the phash structure as the buffer of phash seed. */ phash -> nx_crypto_phash_seed = prf -> nx_secure_tls_prf_label_seed_buffer; + if ((key_size_in_bits + input_length_in_byte) > sizeof(prf -> nx_secure_tls_prf_label_seed_buffer)) + { + return(NX_CRYPTO_SIZE_ERROR); + } /* Concatenate label and seed. */ - NX_CRYPTO_MEMCPY(phash -> nx_crypto_phash_seed, key, key_size_in_bits); - NX_CRYPTO_MEMCPY(&phash -> nx_crypto_phash_seed[key_size_in_bits], input, input_length_in_byte); + NX_CRYPTO_MEMCPY(phash -> nx_crypto_phash_seed, key, key_size_in_bits); + NX_CRYPTO_MEMCPY(&phash -> nx_crypto_phash_seed[key_size_in_bits], input, input_length_in_byte); phash -> nx_crypto_phash_seed_length = key_size_in_bits + input_length_in_byte; /* Install the temp_A_buffer to the phash structure. */ diff --git a/crypto_libraries/src/nx_crypto_xcbc_mac.c b/crypto_libraries/src/nx_crypto_xcbc_mac.c index 1842490b..dbc4d10e 100644 --- a/crypto_libraries/src/nx_crypto_xcbc_mac.c +++ b/crypto_libraries/src/nx_crypto_xcbc_mac.c @@ -27,7 +27,7 @@ /* FUNCTION RELEASE */ /* */ /* _nx_crypto_xcbc_xor PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -59,11 +59,14 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), disabled */ +/* unaligned access by default,*/ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ NX_CRYPTO_KEEP static VOID _nx_crypto_xcbc_xor(UCHAR *plaintext, UCHAR *key, UCHAR *ciphertext) { -#ifndef NX_CRYPTO_DISABLE_UNALIGNED_ACCESS +#ifdef NX_CRYPTO_ENABLE_UNALIGNED_ACCESS UINT *p = (UINT *)plaintext; UINT *c = (UINT *)ciphertext; UINT *k = (UINT *)key; @@ -209,7 +212,7 @@ UINT key_size_in_bits = additional_len; key_set_function(crypto_metadata, key, key_size_in_bits >> 5); crypto_function(crypto_metadata, K2, K2, block_size); - NX_CRYPTO_MEMCPY(pad, input, input_length_in_byte); + NX_CRYPTO_MEMCPY(pad, input, input_length_in_byte); /* XOR M with E and Key K2 or K3 */ _nx_crypto_xcbc_xor(E, pad, E); @@ -219,7 +222,7 @@ UINT key_size_in_bits = additional_len; key_set_function(crypto_metadata, K1, sizeof(K1) >> 2); crypto_function(crypto_metadata, E, E, block_size); - NX_CRYPTO_MEMCPY(output, E, icv_len); + NX_CRYPTO_MEMCPY(output, E, icv_len); #ifdef NX_SECURE_KEY_CLEAR NX_CRYPTO_MEMSET(K1, 0, sizeof(K1)); diff --git a/nx_secure/inc/nx_secure_tls.h b/nx_secure/inc/nx_secure_tls.h index 45c68c02..b8b7cdc8 100644 --- a/nx_secure/inc/nx_secure_tls.h +++ b/nx_secure/inc/nx_secure_tls.h @@ -26,7 +26,7 @@ /* COMPONENT DEFINITION RELEASE */ /* */ /* nx_secure_tls.h PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -41,6 +41,13 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), and */ +/* fixed race condition for */ +/* multithread transmission, */ +/* priority ciphersuite and ECC*/ +/* curve logic, updated product*/ +/* constants, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ @@ -98,16 +105,18 @@ extern "C" { /* ID is used to determine if a TLS session has been initialized. */ #define NX_SECURE_TLS_ID ((ULONG)0x544c5320) -#define EL_PRODUCT_NETX_SECURE +#define AZURE_RTOS_NETX_SECURE #define NETX_SECURE_MAJOR_VERSION 6 #define NETX_SECURE_MINOR_VERSION 0 -#define NETX_SECURE_SERVICE_PACK_VERSION 0 +#define NETX_SECURE_PATCH_VERSION 1 /* The following symbols are defined for backward compatibility reasons. */ +#define EL_PRODUCT_NETX_SECURE #define __PRODUCT_NETX_SECURE__ #define __NETX_SECURE_MAJOR_VERSION__ NETX_SECURE_MAJOR_VERSION #define __NETX_SECURE_MINOR_VERSION__ NETX_SECURE_MINOR_VERSION -#define __NETX_SECURE_SERVICE_PACK_VERSION__ NETX_SECURE_SERVICE_PACK_VERSION +#define __NETX_SECURE_SERVICE_PACK_VERSION__ NETX_SECURE_PATCH_VERSION +#define NETX_SECURE_SERVICE_PACK_VERSION NETX_SECURE_PATCH_VERSION /* Define memcpy, memset and memcmp functions used internal. */ #ifndef NX_SECURE_MEMCPY @@ -229,6 +238,7 @@ extern "C" { #define NX_SECURE_TLS_AEAD_DECRYPT_FAIL 0x150 /* An incoming record did not pass integrity check with AEAD ciphers. */ #define NX_SECURE_TLS_RECORD_OVERFLOW 0x151 /* Received a TLSCiphertext record that had a length too long. */ #define NX_SECURE_TLS_HANDSHAKE_FRAGMENT_RECEIVED 0x152 /* Received a fragmented handshake message - take appropriate action at a higher level of the state machine. */ +#define NX_SECURE_TLS_TRANSMIT_LOCKED 0x153 /* Another thread is transmitting. */ /* NX_CONTINUE is a symbol defined in NetX Duo 5.10. For backward compatibility, this symbol is defined here */ #if ((__NETXDUO_MAJOR_VERSION__ == 5) && (__NETXDUO_MINOR_VERSION__ == 9)) @@ -1131,6 +1141,9 @@ typedef struct NX_SECURE_TLS_SESSION_STRUCT we have not received credentials from the remote host and should fail the handshake. */ USHORT nx_secure_tls_received_remote_credentials; + /* This mutex used for TLS session while transmitting packets. */ + TX_MUTEX nx_secure_tls_session_transmit_mutex; + /* If we receive a hello message from the remote server during a session, we have a re-negotiation handshake we need to process. */ USHORT nx_secure_tls_renegotiation_handshake; @@ -1305,7 +1318,7 @@ UINT _nx_secure_tls_allocate_handshake_packet(NX_SECURE_TLS_SESSION *tls_session UINT _nx_secure_tls_check_protocol_version(NX_SECURE_TLS_SESSION *tls_session, USHORT protocol_version, UINT id); UINT _nx_secure_tls_ciphersuite_lookup(NX_SECURE_TLS_SESSION *tls_session, UINT ciphersuite, - const NX_SECURE_TLS_CIPHERSUITE_INFO **info); + const NX_SECURE_TLS_CIPHERSUITE_INFO **info, USHORT *ciphersuite_priority); UINT _nx_secure_tls_client_handshake(NX_SECURE_TLS_SESSION *tls_session, UCHAR *packet_buffer, UINT data_length, ULONG wait_option); UINT _nx_secure_tls_finished_hash_generate(NX_SECURE_TLS_SESSION *tls_session, @@ -1427,7 +1440,7 @@ UINT _nx_secure_tls_verify_mac(NX_SECURE_TLS_SESSION *tls_session, UCHAR *header UINT _nx_secure_tls_ecc_generate_keys(NX_SECURE_TLS_SESSION *tls_session, UINT ecc_named_curve, USHORT sign_key, UCHAR *public_key, UINT *public_key_size, NX_SECURE_TLS_ECDHE_HANDSHAKE_DATA *ecc_data); UINT _nx_secure_tls_find_curve_method(NX_SECURE_TLS_SESSION *tls_session, - USHORT named_curve, const NX_CRYPTO_METHOD **curve_method); + USHORT named_curve, const NX_CRYPTO_METHOD **curve_method, UINT *curve_priority); UINT _nx_secure_tls_proc_clienthello_sec_sa_extension(NX_SECURE_TLS_SESSION *tls_session, NX_SECURE_TLS_HELLO_EXTENSION *exts, UINT num_extensions, diff --git a/nx_secure/src/nx_secure_dtls_client_handshake.c b/nx_secure/src/nx_secure_dtls_client_handshake.c index 8f8f0024..1fc92be8 100644 --- a/nx_secure/src/nx_secure_dtls_client_handshake.c +++ b/nx_secure/src/nx_secure_dtls_client_handshake.c @@ -181,7 +181,7 @@ NX_SECURE_TLS_SESSION *tls_session; dtls_session -> nx_secure_dtls_fragment_length -= fragment_length; /* Copy the fragment data (minus the header) into the reassembly buffer. */ - NX_SECURE_MEMCPY(&fragment_buffer[fragment_offset], &packet_buffer[header_bytes], fragment_length); + NX_SECURE_MEMCPY(&fragment_buffer[fragment_offset], &packet_buffer[header_bytes], fragment_length); /* If we still have fragments to add, just return success. */ if (dtls_session -> nx_secure_dtls_fragment_length > 0) diff --git a/nx_secure/src/nx_secure_dtls_hash_record.c b/nx_secure/src/nx_secure_dtls_hash_record.c index 30bedec8..bdbb4f01 100644 --- a/nx_secure/src/nx_secure_dtls_hash_record.c +++ b/nx_secure/src/nx_secure_dtls_hash_record.c @@ -116,7 +116,7 @@ NX_SECURE_TLS_SESSION *tls_session; hash_size = tls_session -> nx_secure_tls_session_ciphersuite -> nx_secure_tls_hash_size; /* In DTLS, use the sequence number + epoch from the header. */ - NX_SECURE_MEMCPY(adjusted_sequence_num, &header[3], 8); + NX_SECURE_MEMCPY(adjusted_sequence_num, &header[3], 8); /* We need to extract the type, version, and length from the DTLS header. */ adjusted_header[0] = header[0]; /* Type. */ diff --git a/nx_secure/src/nx_secure_dtls_process_clienthello.c b/nx_secure/src/nx_secure_dtls_process_clienthello.c index e8157076..c68c00d9 100644 --- a/nx_secure/src/nx_secure_dtls_process_clienthello.c +++ b/nx_secure/src/nx_secure_dtls_process_clienthello.c @@ -40,7 +40,7 @@ static UINT _nx_secure_dtls_check_ciphersuite(const NX_SECURE_TLS_CIPHERSUITE_IN /* FUNCTION RELEASE */ /* */ /* _nx_secure_dtls_process_clienthello PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -81,6 +81,12 @@ static UINT _nx_secure_dtls_check_ciphersuite(const NX_SECURE_TLS_CIPHERSUITE_IN /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), added */ +/* priority ciphersuite logic, */ +/* fixed configuration problem */ +/* that would result in */ +/* compiler error, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_dtls_process_clienthello(NX_SECURE_DTLS_SESSION *dtls_session, UCHAR *packet_buffer, @@ -95,13 +101,13 @@ UINT status; USHORT protocol_version; UINT total_extensions_length; const NX_SECURE_TLS_CIPHERSUITE_INFO *ciphersuite_info = NX_NULL; +USHORT ciphersuite_priority; +USHORT new_ciphersuite_priority = 0; NX_SECURE_TLS_SESSION *tls_session; NX_SECURE_TLS_HELLO_EXTENSION extension_data[NX_SECURE_TLS_HELLO_EXTENSIONS_MAX]; UINT num_extensions = NX_SECURE_TLS_HELLO_EXTENSIONS_MAX; UCHAR *ciphersuite_list; -#if defined(NX_SECURE_ENABLE_ECJPAKE_CIPHERSUITE) || defined(NX_SECURE_ENABLE_ECC_CIPHERSUITE) UCHAR *packet_buffer_start; -#endif /* NX_SECURE_ENABLE_ECJPAKE_CIPHERSUITE || NX_SECURE_ENABLE_ECC_CIPHERSUITE */ #ifdef NX_SECURE_ENABLE_ECJPAKE_CIPHERSUITE INT extension_total_length; USHORT extension_length; @@ -133,9 +139,8 @@ NX_SECURE_TLS_ECDHE_HANDSHAKE_DATA *ecdhe_data; return(NX_SECURE_TLS_INCORRECT_MESSAGE_LENGTH); } -#if defined(NX_SECURE_ENABLE_ECJPAKE_CIPHERSUITE) || defined(NX_SECURE_ENABLE_ECC_CIPHERSUITE) + /* Get a pointer to the start of our packet buffer so we can read ahead later. */ packet_buffer_start = packet_buffer; -#endif /* NX_SECURE_ENABLE_ECJPAKE_CIPHERSUITE || NX_SECURE_ENABLE_ECC_CIPHERSUITE */ /* Get a reference to TLS state. */ tls_session = &dtls_session -> nx_secure_dtls_tls_session; @@ -178,7 +183,7 @@ NX_SECURE_TLS_ECDHE_HANDSHAKE_DATA *ecdhe_data; tls_session -> nx_secure_tls_protocol_version = protocol_version; /* Save off the random value for key generation later. */ - NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random, packet_buffer, NX_SECURE_TLS_RANDOM_SIZE); + NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random, packet_buffer, NX_SECURE_TLS_RANDOM_SIZE); packet_buffer += NX_SECURE_TLS_RANDOM_SIZE; /* Extract the session ID if there is one. */ @@ -189,7 +194,7 @@ NX_SECURE_TLS_ECDHE_HANDSHAKE_DATA *ecdhe_data; tls_session -> nx_secure_tls_session_id_length = session_id_length; if (session_id_length > 0) { - NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_session_id, &packet_buffer[0], session_id_length); + NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_session_id, &packet_buffer[0], session_id_length); packet_buffer += session_id_length; } @@ -206,7 +211,7 @@ NX_SECURE_TLS_ECDHE_HANDSHAKE_DATA *ecdhe_data; if (dtls_session -> nx_secure_dtls_cookie_length > 0) { - NX_SECURE_MEMCPY(dtls_session -> nx_secure_dtls_cookie, packet_buffer, dtls_session -> nx_secure_dtls_cookie_length); + NX_SECURE_MEMCPY(dtls_session -> nx_secure_dtls_cookie, packet_buffer, dtls_session -> nx_secure_dtls_cookie_length); packet_buffer += dtls_session -> nx_secure_dtls_cookie_length; } @@ -344,28 +349,32 @@ NX_SECURE_TLS_ECDHE_HANDSHAKE_DATA *ecdhe_data; } #endif /* NX_SECURE_ENABLE_ECC_CIPHERSUITE */ + /* Set our initial priority to the maximum value - the size of our ciphersuite crypto table. */ + ciphersuite_priority = (USHORT)(0xFFFFFFFF); + for (i = 0; i < ciphersuite_list_length; i += 2) { /* Loop through list of acceptable ciphersuites. */ cipher_entry = (USHORT)((ciphersuite_list[i] << 8) + ciphersuite_list[i + 1]); - status = _nx_secure_tls_ciphersuite_lookup(tls_session, cipher_entry, &ciphersuite_info); + status = _nx_secure_tls_ciphersuite_lookup(tls_session, cipher_entry, &ciphersuite_info, &new_ciphersuite_priority); - if (status == NX_SUCCESS) + if (status == NX_SUCCESS && (new_ciphersuite_priority < ciphersuite_priority)) { #ifdef NX_SECURE_ENABLE_ECC_CIPHERSUITE if (NX_SUCCESS == _nx_secure_dtls_check_ciphersuite(ciphersuite_info, cert, selected_curve, cert_curve_supported)) #endif /* NX_SECURE_ENABLE_ECC_CIPHERSUITE */ { tls_session -> nx_secure_tls_session_ciphersuite = ciphersuite_info; - break; + ciphersuite_priority = new_ciphersuite_priority; } } } /* See if we found an acceptable ciphersuite. */ - if (i >= ciphersuite_list_length) + if (tls_session -> nx_secure_tls_session_ciphersuite == NX_NULL) { + /* No supported ciphersuites found. */ return(NX_SECURE_TLS_NO_SUPPORTED_CIPHERS); } diff --git a/nx_secure/src/nx_secure_dtls_process_header.c b/nx_secure/src/nx_secure_dtls_process_header.c index e0084d01..ba6d804b 100644 --- a/nx_secure/src/nx_secure_dtls_process_header.c +++ b/nx_secure/src/nx_secure_dtls_process_header.c @@ -157,8 +157,8 @@ NX_SECURE_TLS_SESSION *tls_session; /* Get epoch and sequence number from header. */ - NX_SECURE_MEMCPY((UCHAR *)&remote_sequence_number[0], &header_data[3], 4); - NX_SECURE_MEMCPY((UCHAR *)&remote_sequence_number[1], &header_data[7], 4); + NX_SECURE_MEMCPY((UCHAR *)&remote_sequence_number[0], &header_data[3], 4); + NX_SECURE_MEMCPY((UCHAR *)&remote_sequence_number[1], &header_data[7], 4); /* Swap endianness for comparisons. */ NX_CHANGE_ULONG_ENDIAN(remote_sequence_number[0]); diff --git a/nx_secure/src/nx_secure_dtls_process_helloverifyrequest.c b/nx_secure/src/nx_secure_dtls_process_helloverifyrequest.c index 710b517f..22aea4a7 100644 --- a/nx_secure/src/nx_secure_dtls_process_helloverifyrequest.c +++ b/nx_secure/src/nx_secure_dtls_process_helloverifyrequest.c @@ -30,7 +30,7 @@ /* FUNCTION RELEASE */ /* */ /* _nx_secure_dtls_process_helloverifyrequest PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -62,6 +62,9 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), improved */ +/* buffer length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_dtls_process_helloverifyrequest(NX_SECURE_DTLS_SESSION *dtls_session, @@ -69,7 +72,6 @@ UINT _nx_secure_dtls_process_helloverifyrequest(NX_SECURE_DTLS_SESSION *dtls_ses { UINT length; - NX_PARAMETER_NOT_USED(message_length); /* Parse the HelloVerifyRequest message. * Structure: @@ -92,8 +94,13 @@ UINT length; return(NX_SECURE_TLS_INCORRECT_MESSAGE_LENGTH); } + if ((3u + dtls_session -> nx_secure_dtls_cookie_length) > message_length) + { + return(NX_SECURE_TLS_INCORRECT_MESSAGE_LENGTH); + } + /* Save off the cookie. */ - NX_SECURE_MEMCPY(dtls_session -> nx_secure_dtls_cookie, &packet_buffer[length], dtls_session -> nx_secure_dtls_cookie_length); + NX_SECURE_MEMCPY(dtls_session -> nx_secure_dtls_cookie, &packet_buffer[length], dtls_session -> nx_secure_dtls_cookie_length); /* Set our state to indicate we sucessfully parsed the HelloVerifyRequest. */ dtls_session -> nx_secure_dtls_tls_session.nx_secure_tls_client_state = NX_SECURE_TLS_CLIENT_STATE_HELLO_VERIFY; diff --git a/nx_secure/src/nx_secure_dtls_send_clienthello.c b/nx_secure/src/nx_secure_dtls_send_clienthello.c index 3cfbc2d1..f6530bc8 100644 --- a/nx_secure/src/nx_secure_dtls_send_clienthello.c +++ b/nx_secure/src/nx_secure_dtls_send_clienthello.c @@ -172,7 +172,7 @@ USHORT protocol_version; /* Set cookie. */ NX_SECURE_MEMCPY(packet_buffer, dtls_session -> nx_secure_dtls_cookie, - dtls_session -> nx_secure_dtls_cookie_length); + dtls_session -> nx_secure_dtls_cookie_length); length += dtls_session -> nx_secure_dtls_cookie_length; /* Finally, we have a complete length and can put it into the buffer. Before that, @@ -197,7 +197,7 @@ USHORT protocol_version; gmt_time = tls_session -> nx_secure_tls_session_time_function(); } NX_CHANGE_ULONG_ENDIAN(gmt_time); - NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random, (UCHAR *)&gmt_time, sizeof(gmt_time)); + NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random, (UCHAR *)&gmt_time, sizeof(gmt_time)); /* Next 28 bytes is random data. */ for (i = 0; i < 28; i += (UINT)sizeof(random_value)) @@ -212,7 +212,7 @@ USHORT protocol_version; /* Copy the random data into the packet. */ NX_SECURE_MEMCPY(&packet_buffer[length], tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random, - sizeof(tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random)); + sizeof(tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random)); length += sizeof(tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random); /* Session ID length is one byte. */ @@ -222,7 +222,7 @@ USHORT protocol_version; /* Session ID follows. */ if (tls_session -> nx_secure_tls_session_id_length > 0) { - NX_SECURE_MEMCPY(&packet_buffer[length], tls_session -> nx_secure_tls_session_id, tls_session -> nx_secure_tls_session_id_length); + NX_SECURE_MEMCPY(&packet_buffer[length], tls_session -> nx_secure_tls_session_id, tls_session -> nx_secure_tls_session_id_length); length += tls_session -> nx_secure_tls_session_id_length; } diff --git a/nx_secure/src/nx_secure_dtls_send_helloverifyrequest.c b/nx_secure/src/nx_secure_dtls_send_helloverifyrequest.c index ecced03d..174ee836 100644 --- a/nx_secure/src/nx_secure_dtls_send_helloverifyrequest.c +++ b/nx_secure/src/nx_secure_dtls_send_helloverifyrequest.c @@ -111,7 +111,7 @@ USHORT protocol_version; random_value = (UINT)NX_RAND(); NX_CHANGE_ULONG_ENDIAN(random_value); NX_SECURE_MEMCPY(&dtls_session -> nx_secure_dtls_cookie[i], - (UCHAR *)&random_value, sizeof(random_value)); + (UCHAR *)&random_value, sizeof(random_value)); } if (dtls_session -> nx_secure_dtls_cookie_length > sizeof(dtls_session -> nx_secure_dtls_cookie)) @@ -122,7 +122,7 @@ USHORT protocol_version; } /* Copy the cookie into the packet. */ - NX_SECURE_MEMCPY(&packet_buffer[length], dtls_session -> nx_secure_dtls_cookie, dtls_session -> nx_secure_dtls_cookie_length); + NX_SECURE_MEMCPY(&packet_buffer[length], dtls_session -> nx_secure_dtls_cookie, dtls_session -> nx_secure_dtls_cookie_length); length += dtls_session -> nx_secure_dtls_cookie_length; /* Save off and return the number of bytes we wrote and need to send. */ diff --git a/nx_secure/src/nx_secure_dtls_send_record.c b/nx_secure/src/nx_secure_dtls_send_record.c index 5b9eef36..92cf1d9a 100644 --- a/nx_secure/src/nx_secure_dtls_send_record.c +++ b/nx_secure/src/nx_secure_dtls_send_record.c @@ -209,7 +209,7 @@ UCHAR epoch_seq_num[8]; } /* Append the hash to the plaintext data before encryption. */ - NX_SECURE_MEMCPY(&data[length], record_hash, hash_length); + NX_SECURE_MEMCPY(&data[length], record_hash, hash_length); #ifdef NX_SECURE_KEY_CLEAR NX_SECURE_MEMSET(record_hash, 0, hash_length); diff --git a/nx_secure/src/nx_secure_dtls_send_serverhello.c b/nx_secure/src/nx_secure_dtls_send_serverhello.c index de6e4b24..fde9c0b9 100644 --- a/nx_secure/src/nx_secure_dtls_send_serverhello.c +++ b/nx_secure/src/nx_secure_dtls_send_serverhello.c @@ -128,7 +128,7 @@ USHORT protocol_version; } NX_CHANGE_ULONG_ENDIAN(gmt_time); - NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random, (UCHAR *)&gmt_time, sizeof(gmt_time)); + NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random, (UCHAR *)&gmt_time, sizeof(gmt_time)); /* Next 28 bytes is random data. */ for (i = 0; i < 28; i += (UINT)sizeof(random_value)) @@ -142,7 +142,7 @@ USHORT protocol_version; /* Copy the random data into the packet. */ NX_SECURE_MEMCPY(&packet_buffer[length], tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random, - sizeof(tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random)); + sizeof(tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random)); length += sizeof(tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random); /* Session ID length is one byte. */ @@ -152,7 +152,7 @@ USHORT protocol_version; /* Session ID follows. */ if (tls_session -> nx_secure_tls_session_id_length > 0) { - NX_SECURE_MEMCPY(&packet_buffer[length], tls_session -> nx_secure_tls_session_id, tls_session -> nx_secure_tls_session_id_length); + NX_SECURE_MEMCPY(&packet_buffer[length], tls_session -> nx_secure_tls_session_id, tls_session -> nx_secure_tls_session_id_length); length += tls_session -> nx_secure_tls_session_id_length; } diff --git a/nx_secure/src/nx_secure_dtls_server_handshake.c b/nx_secure/src/nx_secure_dtls_server_handshake.c index 90f756b4..e367d142 100644 --- a/nx_secure/src/nx_secure_dtls_server_handshake.c +++ b/nx_secure/src/nx_secure_dtls_server_handshake.c @@ -180,7 +180,7 @@ UCHAR *fragment_buffer; dtls_session -> nx_secure_dtls_fragment_length -= fragment_length; /* Copy the fragment data (minus the header) into the reassembly buffer. */ - NX_SECURE_MEMCPY(&fragment_buffer[fragment_offset], &packet_buffer[header_bytes], fragment_length); + NX_SECURE_MEMCPY(&fragment_buffer[fragment_offset], &packet_buffer[header_bytes], fragment_length); /* If we still have fragments to add, just return success. */ if (dtls_session -> nx_secure_dtls_fragment_length > 0) diff --git a/nx_secure/src/nx_secure_dtls_server_local_certificate_add.c b/nx_secure/src/nx_secure_dtls_server_local_certificate_add.c index ff147357..3427ed8d 100644 --- a/nx_secure/src/nx_secure_dtls_server_local_certificate_add.c +++ b/nx_secure/src/nx_secure_dtls_server_local_certificate_add.c @@ -29,7 +29,7 @@ /* FUNCTION RELEASE */ /* */ /* _nx_secure_dtls_server_local_certificate_add PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -66,6 +66,9 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), and */ +/* fixed compiler warnings, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_dtls_server_local_certificate_add(NX_SECURE_DTLS_SERVER *server_ptr, @@ -76,7 +79,7 @@ UINT status; UINT i; NX_SECURE_DTLS_SESSION *current_session; NX_SECURE_TLS_SESSION *tls_session; -NX_SECURE_X509_CERT *list_head; +NX_SECURE_X509_CERT *list_head = NX_NULL; UINT num_sessions; /* Figure out number of sessions. */ diff --git a/nx_secure/src/nx_secure_dtls_server_local_certificate_remove.c b/nx_secure/src/nx_secure_dtls_server_local_certificate_remove.c index 13b63bdc..8eaeae18 100644 --- a/nx_secure/src/nx_secure_dtls_server_local_certificate_remove.c +++ b/nx_secure/src/nx_secure_dtls_server_local_certificate_remove.c @@ -29,7 +29,7 @@ /* FUNCTION RELEASE */ /* */ /* _nx_secure_dtls_server_local_certificate_remove PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -68,6 +68,9 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), and */ +/* fixed compiler warnings, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_dtls_server_local_certificate_remove(NX_SECURE_DTLS_SERVER *server_ptr, @@ -78,7 +81,7 @@ UINT status; UINT i; NX_SECURE_DTLS_SESSION *current_session; NX_SECURE_TLS_SESSION *tls_session; -NX_SECURE_X509_CERT *list_head; +NX_SECURE_X509_CERT *list_head = NX_NULL; UINT num_sessions; /* Figure out number of sessions. */ diff --git a/nx_secure/src/nx_secure_dtls_server_trusted_certificate_add.c b/nx_secure/src/nx_secure_dtls_server_trusted_certificate_add.c index 08bbaf7b..752a3851 100644 --- a/nx_secure/src/nx_secure_dtls_server_trusted_certificate_add.c +++ b/nx_secure/src/nx_secure_dtls_server_trusted_certificate_add.c @@ -29,7 +29,7 @@ /* FUNCTION RELEASE */ /* */ /* _nx_secure_dtls_server_trusted_certificate_add PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -65,6 +65,9 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), and */ +/* fixed compiler warnings, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_dtls_server_trusted_certificate_add(NX_SECURE_DTLS_SERVER *server_ptr, @@ -75,7 +78,7 @@ UINT status; UINT i; NX_SECURE_DTLS_SESSION *current_session; NX_SECURE_TLS_SESSION *tls_session; -NX_SECURE_X509_CERT *list_head; +NX_SECURE_X509_CERT *list_head = NX_NULL; UINT num_sessions; /* Figure out number of sessions. */ diff --git a/nx_secure/src/nx_secure_dtls_server_trusted_certificate_remove.c b/nx_secure/src/nx_secure_dtls_server_trusted_certificate_remove.c index dfa1e498..2eed3c4d 100644 --- a/nx_secure/src/nx_secure_dtls_server_trusted_certificate_remove.c +++ b/nx_secure/src/nx_secure_dtls_server_trusted_certificate_remove.c @@ -29,7 +29,7 @@ /* FUNCTION RELEASE */ /* */ /* _nx_secure_dtls_server_trusted_certificate_remove PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -68,6 +68,9 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), and */ +/* fixed compiler warnings, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_dtls_server_trusted_certificate_remove(NX_SECURE_DTLS_SERVER *server_ptr, @@ -78,7 +81,7 @@ UINT status; UINT i; NX_SECURE_DTLS_SESSION *current_session; NX_SECURE_TLS_SESSION *tls_session; -NX_SECURE_X509_CERT *list_head; +NX_SECURE_X509_CERT *list_head = NX_NULL; UINT num_sessions; diff --git a/nx_secure/src/nx_secure_dtls_session_cache.c b/nx_secure/src/nx_secure_dtls_session_cache.c index 7a66caa0..7c323c4d 100644 --- a/nx_secure/src/nx_secure_dtls_session_cache.c +++ b/nx_secure/src/nx_secure_dtls_session_cache.c @@ -187,7 +187,7 @@ UINT i; if (session_array[i].nx_secure_dtls_session_in_use == NX_FALSE) { /* Set the IP and port to the passed-in values. */ - NX_SECURE_MEMCPY(&session_array[i].nx_secure_dtls_remote_ip_address, ip_address, sizeof(NXD_ADDRESS)); + NX_SECURE_MEMCPY(&session_array[i].nx_secure_dtls_remote_ip_address, ip_address, sizeof(NXD_ADDRESS)); session_array[i].nx_secure_dtls_local_port = local_port; session_array[i].nx_secure_dtls_remote_port = remote_port; session_array[i].nx_secure_dtls_session_in_use = NX_TRUE; diff --git a/nx_secure/src/nx_secure_dtls_session_send.c b/nx_secure/src/nx_secure_dtls_session_send.c index 67de4517..2eab9e28 100644 --- a/nx_secure/src/nx_secure_dtls_session_send.c +++ b/nx_secure/src/nx_secure_dtls_session_send.c @@ -82,7 +82,7 @@ UINT status; { /* If the IP Address and port are uninitialized, set them now (possibly an error?). */ - NX_SECURE_MEMCPY(&dtls_session -> nx_secure_dtls_remote_ip_address, ip_address, sizeof(NXD_ADDRESS)); + NX_SECURE_MEMCPY(&dtls_session -> nx_secure_dtls_remote_ip_address, ip_address, sizeof(NXD_ADDRESS)); dtls_session -> nx_secure_dtls_local_port = port; } else if ((dtls_session -> nx_secure_dtls_remote_ip_address.nxd_ip_version != ip_address -> nxd_ip_version) || diff --git a/nx_secure/src/nx_secure_dtls_verify_mac.c b/nx_secure/src/nx_secure_dtls_verify_mac.c index c80d6bae..0af05a39 100644 --- a/nx_secure/src/nx_secure_dtls_verify_mac.c +++ b/nx_secure/src/nx_secure_dtls_verify_mac.c @@ -123,7 +123,7 @@ NX_SECURE_TLS_SESSION *tls_session; { return(NX_SECURE_TLS_HASH_MAC_VERIFY_FAILURE); } - NX_SECURE_MEMCPY(header, header_data, header_length); + NX_SECURE_MEMCPY(header, header_data, header_length); /* Adjust the length in the header to match data without hash. */ diff --git a/nx_secure/src/nx_secure_tls_1_3_generate_keys.c b/nx_secure/src/nx_secure_tls_1_3_generate_keys.c index 73643de5..5b200b47 100644 --- a/nx_secure/src/nx_secure_tls_1_3_generate_keys.c +++ b/nx_secure/src/nx_secure_tls_1_3_generate_keys.c @@ -1385,9 +1385,9 @@ const NX_CRYPTO_METHOD *session_hmac_method = NX_NULL; data_len = data_len + 1; /* Now copy in label with TLS 1.3 prefix. */ - NX_CRYPTO_MEMCPY(&_nx_secure_tls_hkdf_temp_output[data_len], "tls13 ", 6); + NX_CRYPTO_MEMCPY(&_nx_secure_tls_hkdf_temp_output[data_len], "tls13 ", 6); data_len += 6; - NX_CRYPTO_MEMCPY(&_nx_secure_tls_hkdf_temp_output[data_len], label, label_len); + NX_CRYPTO_MEMCPY(&_nx_secure_tls_hkdf_temp_output[data_len], label, label_len); data_len += label_len; /* Add the length of the context (single octet). */ @@ -1395,7 +1395,7 @@ const NX_CRYPTO_METHOD *session_hmac_method = NX_NULL; data_len = data_len + 1; /* Now copy in context. */ - NX_CRYPTO_MEMCPY(&_nx_secure_tls_hkdf_temp_output[data_len], context, context_len); + NX_CRYPTO_MEMCPY(&_nx_secure_tls_hkdf_temp_output[data_len], context, context_len); data_len += context_len; diff --git a/nx_secure/src/nx_secure_tls_1_3_session_keys_set.c b/nx_secure/src/nx_secure_tls_1_3_session_keys_set.c index 2044b97a..ec196437 100644 --- a/nx_secure/src/nx_secure_tls_1_3_session_keys_set.c +++ b/nx_secure/src/nx_secure_tls_1_3_session_keys_set.c @@ -135,12 +135,12 @@ const NX_CRYPTO_METHOD *session_cipher_method = NX_NULL; if (is_client) { NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_write_key, - tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_next_write_key, key_size); + tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_next_write_key, key_size); } else { NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_write_key, - tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_next_write_key, key_size); + tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_next_write_key, key_size); } } @@ -151,12 +151,12 @@ const NX_CRYPTO_METHOD *session_cipher_method = NX_NULL; if (is_client) { NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_iv, - tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_next_iv, iv_size); + tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_next_iv, iv_size); } else { NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_iv, - tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_next_iv, iv_size); + tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_next_iv, iv_size); } } diff --git a/nx_secure/src/nx_secure_tls_1_3_transcript_hash_save.c b/nx_secure/src/nx_secure_tls_1_3_transcript_hash_save.c index db8f7cd6..58b0c854 100644 --- a/nx_secure/src/nx_secure_tls_1_3_transcript_hash_save.c +++ b/nx_secure/src/nx_secure_tls_1_3_transcript_hash_save.c @@ -106,7 +106,7 @@ CHAR *metadata; /* Copy over the handshake hash state into a local structure to do the intermediate calculation. */ NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch, tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata, - tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata_size); + tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata_size); metadata = tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch; } diff --git a/nx_secure/src/nx_secure_tls_ciphersuite_lookup.c b/nx_secure/src/nx_secure_tls_ciphersuite_lookup.c index 44f08872..84a05775 100644 --- a/nx_secure/src/nx_secure_tls_ciphersuite_lookup.c +++ b/nx_secure/src/nx_secure_tls_ciphersuite_lookup.c @@ -29,7 +29,7 @@ /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_ciphersuite_lookup PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -46,6 +46,8 @@ /* ciphersuite Ciphersuite value */ /* info Pointer to ciphersuite info */ /* structure (output) */ +/* priority Priority index of ciphersuite */ +/* in the ciphersuite table */ /* */ /* OUTPUT */ /* */ @@ -66,10 +68,13 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), return */ +/* priority of selected suite, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_tls_ciphersuite_lookup(NX_SECURE_TLS_SESSION *tls_session, UINT ciphersuite, - NX_SECURE_TLS_CIPHERSUITE_INFO const **info) + NX_SECURE_TLS_CIPHERSUITE_INFO const **info, USHORT *priority) { USHORT index; NX_SECURE_TLS_CIPHERSUITE_INFO *cipher_table; @@ -84,7 +89,11 @@ USHORT cipher_table_size; /* See if the ciphersuite is supported. */ if (cipher_table[index].nx_secure_tls_ciphersuite == ciphersuite) { + /* Return the ciphersuite information. */ *info = &cipher_table[index]; + + /* Return the priority index (lower number == higher priority). */ + *priority = index; return(NX_SUCCESS); } } diff --git a/nx_secure/src/nx_secure_tls_client_psk_set.c b/nx_secure/src/nx_secure_tls_client_psk_set.c index 74fd317f..40369165 100644 --- a/nx_secure/src/nx_secure_tls_client_psk_set.c +++ b/nx_secure/src/nx_secure_tls_client_psk_set.c @@ -86,15 +86,15 @@ UINT status; hint_length <= NX_SECURE_TLS_MAX_PSK_ID_SIZE) { /* Save off the PSK and its length. */ - NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_credentials.nx_secure_tls_client_psk.nx_secure_tls_psk_data, pre_shared_key, psk_length); + NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_credentials.nx_secure_tls_client_psk.nx_secure_tls_psk_data, pre_shared_key, psk_length); tls_session -> nx_secure_tls_credentials.nx_secure_tls_client_psk.nx_secure_tls_psk_data_size = psk_length; /* Save off the identity and its length. */ - NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_credentials.nx_secure_tls_client_psk.nx_secure_tls_psk_id, psk_identity, identity_length); + NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_credentials.nx_secure_tls_client_psk.nx_secure_tls_psk_id, psk_identity, identity_length); tls_session -> nx_secure_tls_credentials.nx_secure_tls_client_psk.nx_secure_tls_psk_id_size = identity_length; /* Save off the hint and its length. */ - NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_credentials.nx_secure_tls_client_psk.nx_secure_tls_psk_id_hint, hint, hint_length); + NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_credentials.nx_secure_tls_client_psk.nx_secure_tls_psk_id_hint, hint, hint_length); tls_session -> nx_secure_tls_credentials.nx_secure_tls_client_psk.nx_secure_tls_psk_id_hint_size = hint_length; status = NX_SUCCESS; diff --git a/nx_secure/src/nx_secure_tls_ecc_generate_keys.c b/nx_secure/src/nx_secure_tls_ecc_generate_keys.c index 5560d4a9..717bffa6 100644 --- a/nx_secure/src/nx_secure_tls_ecc_generate_keys.c +++ b/nx_secure/src/nx_secure_tls_ecc_generate_keys.c @@ -47,7 +47,7 @@ static const UCHAR _NX_CRYPTO_DER_OID_SHA_512[] = {0x30, 0x51, 0x30, 0x0d, /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_ecc_generate_keys PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -92,6 +92,9 @@ static const UCHAR _NX_CRYPTO_DER_OID_SHA_512[] = {0x30, 0x51, 0x30, 0x0d, /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), update */ +/* ECC find curve method, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_tls_ecc_generate_keys(NX_SECURE_TLS_SESSION *tls_session, UINT ecc_named_curve, USHORT sign_key, @@ -148,7 +151,7 @@ USHORT signature_algorithm_id; ecc_data->nx_secure_tls_ecdhe_named_curve = ecc_named_curve; /* Find out which named curve the we are using. */ - status = _nx_secure_tls_find_curve_method(tls_session, (USHORT)ecc_named_curve, &curve_method); + status = _nx_secure_tls_find_curve_method(tls_session, (USHORT)ecc_named_curve, &curve_method, NX_NULL); if(status != NX_SUCCESS) { return(status); @@ -726,10 +729,10 @@ USHORT signature_algorithm_id; _nx_secure_padded_signature[signature_offset - 1] = 0x0; if (der_encoding_length > 0) { - NX_CRYPTO_MEMCPY(&_nx_secure_padded_signature[signature_offset], der_encoding, der_encoding_length); + NX_CRYPTO_MEMCPY(&_nx_secure_padded_signature[signature_offset], der_encoding, der_encoding_length); signature_offset += der_encoding_length; } - NX_CRYPTO_MEMCPY(&_nx_secure_padded_signature[signature_offset], hash, hash_length); + NX_CRYPTO_MEMCPY(&_nx_secure_padded_signature[signature_offset], hash, hash_length); if (auth_method -> nx_crypto_init != NX_NULL) { @@ -787,7 +790,7 @@ USHORT signature_algorithm_id; ec_pubkey = &certificate -> nx_secure_x509_public_key.ec_public_key; /* Find out which named curve the local certificate is using. */ - status = _nx_secure_tls_find_curve_method(tls_session, (USHORT)(ec_privkey -> nx_secure_ec_named_curve), &curve_method_cert); + status = _nx_secure_tls_find_curve_method(tls_session, (USHORT)(ec_privkey -> nx_secure_ec_named_curve), &curve_method_cert, NX_NULL); if(status != NX_SUCCESS) { return(status); diff --git a/nx_secure/src/nx_secure_tls_find_curve_method.c b/nx_secure/src/nx_secure_tls_find_curve_method.c index ffd4e420..854833fe 100644 --- a/nx_secure/src/nx_secure_tls_find_curve_method.c +++ b/nx_secure/src/nx_secure_tls_find_curve_method.c @@ -33,7 +33,7 @@ extern NX_SECURE_TLS_ECC _nx_secure_tls_ecc_info; /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_find_curve_method PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -49,6 +49,8 @@ extern NX_SECURE_TLS_ECC _nx_secure_tls_ecc_info; /* named_curve Named curve ID */ /* curve_method Pointer to hold the curve */ /* method */ +/* curve_priority Pointer to return value for */ +/* priority value */ /* */ /* OUTPUT */ /* */ @@ -83,10 +85,13 @@ extern NX_SECURE_TLS_ECC _nx_secure_tls_ecc_info; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), added */ +/* curve priority return value,*/ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_tls_find_curve_method(NX_SECURE_TLS_SESSION *tls_session, - USHORT named_curve, const NX_CRYPTO_METHOD **curve_method) + USHORT named_curve, const NX_CRYPTO_METHOD **curve_method, UINT *curve_priority) { USHORT i; NX_SECURE_TLS_ECC *ecc_info; @@ -107,6 +112,12 @@ NX_SECURE_TLS_ECC *ecc_info; if (named_curve == ecc_info -> nx_secure_tls_ecc_supported_groups[i]) { *curve_method = ecc_info -> nx_secure_tls_ecc_curves[i]; + + /* The index in the supported list is the curve priority: lower value == higher priority. */ + if(curve_priority != NX_NULL) + { + *curve_priority = i; + } break; } } diff --git a/nx_secure/src/nx_secure_tls_finished_hash_generate.c b/nx_secure/src/nx_secure_tls_finished_hash_generate.c index 4fbbab9d..adf5947e 100644 --- a/nx_secure/src/nx_secure_tls_finished_hash_generate.c +++ b/nx_secure/src/nx_secure_tls_finished_hash_generate.c @@ -132,7 +132,7 @@ UINT hash_size = 0; /* Copy over the handshake hash state into scratch space to do the intermediate calculation. */ NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch, tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata, - tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata_size); + tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata_size); /* Finalize the handshake message hash that we started at the beginning of the handshake. */ method_ptr = tls_session -> nx_secure_tls_crypto_table -> nx_secure_tls_handshake_hash_sha256_method; @@ -187,11 +187,11 @@ UINT hash_size = 0; first, then MD5. */ NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch, tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha1_metadata, - tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha1_metadata_size); + tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha1_metadata_size); NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch + tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha1_metadata_size, tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_md5_metadata, - tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_md5_metadata_size); + tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_md5_metadata_size); /* Finalize the handshake message hashes that we started at the beginning of the handshake. */ method_ptr = tls_session -> nx_secure_tls_crypto_table -> nx_secure_tls_handshake_hash_md5_method; diff --git a/nx_secure/src/nx_secure_tls_generate_keys.c b/nx_secure/src/nx_secure_tls_generate_keys.c index c4b89dfc..0eab82b7 100644 --- a/nx_secure/src/nx_secure_tls_generate_keys.c +++ b/nx_secure/src/nx_secure_tls_generate_keys.c @@ -142,9 +142,9 @@ VOID *handler = NX_NULL; /* Concatenate random values to feed into PRF. */ NX_SECURE_MEMCPY(_nx_secure_tls_gen_keys_random, tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random, - NX_SECURE_TLS_RANDOM_SIZE); + NX_SECURE_TLS_RANDOM_SIZE); NX_SECURE_MEMCPY(&_nx_secure_tls_gen_keys_random[NX_SECURE_TLS_RANDOM_SIZE], - tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random, NX_SECURE_TLS_RANDOM_SIZE); + tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random, NX_SECURE_TLS_RANDOM_SIZE); /* Generate the master secret using the pre-master secret, the defined TLS label, and the concatenated random values. */ @@ -290,9 +290,9 @@ VOID *handler = NX_NULL; /* The order of the randoms is reversed from that used for the master secret when generating the key block. */ NX_SECURE_MEMCPY(_nx_secure_tls_gen_keys_random, tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random, - NX_SECURE_TLS_RANDOM_SIZE); + NX_SECURE_TLS_RANDOM_SIZE); NX_SECURE_MEMCPY(&_nx_secure_tls_gen_keys_random[NX_SECURE_TLS_RANDOM_SIZE], - tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random, NX_SECURE_TLS_RANDOM_SIZE); + tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random, NX_SECURE_TLS_RANDOM_SIZE); /* Key expansion uses the PRF to generate a block of key material from the master secret (generated above) and the client and server random values transmitted during the initial hello negotiation. */ diff --git a/nx_secure/src/nx_secure_tls_generate_premaster_secret.c b/nx_secure/src/nx_secure_tls_generate_premaster_secret.c index 14a25124..b0dcc824 100644 --- a/nx_secure/src/nx_secure_tls_generate_premaster_secret.c +++ b/nx_secure/src/nx_secure_tls_generate_premaster_secret.c @@ -29,7 +29,7 @@ /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_generate_premaster_secret PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -68,6 +68,9 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), update */ +/* ECC find curve method, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_tls_generate_premaster_secret(NX_SECURE_TLS_SESSION *tls_session, UINT id) @@ -117,7 +120,7 @@ NX_CRYPTO_EXTENDED_OUTPUT extended_output; ec_pubkey = &server_certificate -> nx_secure_x509_public_key.ec_public_key; /* Find out which named curve the remote certificate is using. */ - status = _nx_secure_tls_find_curve_method(tls_session, (USHORT)(ec_pubkey -> nx_secure_ec_named_curve), &curve_method_cert); + status = _nx_secure_tls_find_curve_method(tls_session, (USHORT)(ec_pubkey -> nx_secure_ec_named_curve), &curve_method_cert, NX_NULL); if(status != NX_SUCCESS) { @@ -263,7 +266,7 @@ NX_CRYPTO_EXTENDED_OUTPUT extended_output; tls_session -> nx_secure_tls_key_material.nx_secure_tls_pre_master_secret[index + 1] = (UCHAR)psk_length; index += 2; - NX_SECURE_MEMCPY(&tls_session -> nx_secure_tls_key_material.nx_secure_tls_pre_master_secret[index], psk_data, psk_length); + NX_SECURE_MEMCPY(&tls_session -> nx_secure_tls_key_material.nx_secure_tls_pre_master_secret[index], psk_data, psk_length); index += psk_length; /* Save the pre-master secret size for later use. */ diff --git a/nx_secure/src/nx_secure_tls_process_certificate_verify.c b/nx_secure/src/nx_secure_tls_process_certificate_verify.c index 47cd8cc1..ceefd392 100644 --- a/nx_secure/src/nx_secure_tls_process_certificate_verify.c +++ b/nx_secure/src/nx_secure_tls_process_certificate_verify.c @@ -39,7 +39,7 @@ static const UCHAR _NX_SECURE_OID_SHA256[] = {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09 /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_process_certificate_verify PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -81,6 +81,9 @@ static const UCHAR _NX_SECURE_OID_SHA256[] = {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09 /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), update */ +/* ECC find curve method, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_tls_process_certificate_verify(NX_SECURE_TLS_SESSION *tls_session, @@ -215,16 +218,16 @@ NX_SECURE_EC_PUBLIC_KEY *ec_pubkey; if (tls_session -> nx_secure_tls_socket_type == NX_SECURE_TLS_SESSION_TYPE_CLIENT) { /* Copy in context string and 0-byte separator. */ - NX_SECURE_MEMCPY(&handshake_hash[64], server_context, 34); + NX_SECURE_MEMCPY(&handshake_hash[64], server_context, 34); } else { /* Copy in context string and 0-byte separator. */ - NX_SECURE_MEMCPY(&handshake_hash[64], client_context, 34); + NX_SECURE_MEMCPY(&handshake_hash[64], client_context, 34); } /* Copy in transcript hash. */ - NX_SECURE_MEMCPY(&handshake_hash[64 + 34], transcript_hash, 32); + NX_SECURE_MEMCPY(&handshake_hash[64 + 34], transcript_hash, 32); handshake_hash_length = 130; @@ -344,7 +347,7 @@ NX_SECURE_EC_PUBLIC_KEY *ec_pubkey; /* Copy over the handshake hash state into a local structure to do the intermediate calculation. */ NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch, tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata, - tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata_size); + tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata_size); /* Use SHA-256 for now... */ hash_method = tls_session -> nx_secure_tls_crypto_table -> nx_secure_tls_handshake_hash_sha256_method; @@ -393,11 +396,11 @@ NX_SECURE_EC_PUBLIC_KEY *ec_pubkey; first, then MD5. */ NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch, tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha1_metadata, - tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha1_metadata_size); + tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha1_metadata_size); NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch + tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha1_metadata_size, tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_md5_metadata, - tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_md5_metadata_size); + tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_md5_metadata_size); /* Finalize the handshake message hashes that we started at the beginning of the handshake. */ hash_method = tls_session -> nx_secure_tls_crypto_table -> nx_secure_tls_handshake_hash_md5_method; @@ -743,7 +746,7 @@ NX_SECURE_EC_PUBLIC_KEY *ec_pubkey; ec_pubkey = &client_certificate -> nx_secure_x509_public_key.ec_public_key; /* Find out which named curve the remote certificate is using. */ - status = _nx_secure_tls_find_curve_method(tls_session, (USHORT)(ec_pubkey -> nx_secure_ec_named_curve), &curve_method_cert); + status = _nx_secure_tls_find_curve_method(tls_session, (USHORT)(ec_pubkey -> nx_secure_ec_named_curve), &curve_method_cert, NX_NULL); #ifdef NX_SECURE_KEY_CLEAR if(status != NX_SUCCESS || curve_method_cert == NX_NULL) diff --git a/nx_secure/src/nx_secure_tls_process_client_key_exchange.c b/nx_secure/src/nx_secure_tls_process_client_key_exchange.c index 7739bb69..6c07701d 100644 --- a/nx_secure/src/nx_secure_tls_process_client_key_exchange.c +++ b/nx_secure/src/nx_secure_tls_process_client_key_exchange.c @@ -31,7 +31,7 @@ static UCHAR _nx_secure_client_padded_pre_master[600]; /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_process_client_key_exchange PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -76,6 +76,9 @@ static UCHAR _nx_secure_client_padded_pre_master[600]; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), update */ +/* ECC find curve method, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_tls_process_client_key_exchange(NX_SECURE_TLS_SESSION *tls_session, @@ -205,7 +208,7 @@ UINT private_key_length; ec_privkey = &local_certificate -> nx_secure_x509_private_key.ec_private_key; /* Find out which named curve the local certificate is using. */ - status = _nx_secure_tls_find_curve_method(tls_session, (USHORT)(ec_privkey -> nx_secure_ec_named_curve), &curve_method); + status = _nx_secure_tls_find_curve_method(tls_session, (USHORT)(ec_privkey -> nx_secure_ec_named_curve), &curve_method, NX_NULL); if(status != NX_SUCCESS) { @@ -220,7 +223,7 @@ UINT private_key_length; ecdhe_data = (NX_SECURE_TLS_ECDHE_HANDSHAKE_DATA *)tls_session -> nx_secure_tls_key_material.nx_secure_tls_new_key_material_data; /* Find out which named curve the we are using. */ - status = _nx_secure_tls_find_curve_method(tls_session, (USHORT)ecdhe_data -> nx_secure_tls_ecdhe_named_curve, &curve_method); + status = _nx_secure_tls_find_curve_method(tls_session, (USHORT)ecdhe_data -> nx_secure_tls_ecdhe_named_curve, &curve_method, NX_NULL); if(status != NX_SUCCESS) { @@ -337,7 +340,7 @@ UINT private_key_length; { length = sizeof(tls_session -> nx_secure_tls_key_material.nx_secure_tls_pre_master_secret); } - NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_pre_master_secret, encrypted_pre_master_secret, length); + NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_pre_master_secret, encrypted_pre_master_secret, length); tls_session -> nx_secure_tls_key_material.nx_secure_tls_pre_master_secret_size = length; } @@ -527,7 +530,7 @@ UINT private_key_length; /* Extract the 48 bytes of the actual pre-master secret from the data we just decrypted, stripping the padding, which comes at the beginning of the decrypted block (the pre-master secret is the last 48 bytes. */ NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_pre_master_secret, - &_nx_secure_client_padded_pre_master[length - NX_SECURE_TLS_RSA_PREMASTER_SIZE], NX_SECURE_TLS_RSA_PREMASTER_SIZE); + &_nx_secure_client_padded_pre_master[length - NX_SECURE_TLS_RSA_PREMASTER_SIZE], NX_SECURE_TLS_RSA_PREMASTER_SIZE); } tls_session -> nx_secure_tls_key_material.nx_secure_tls_pre_master_secret_size = NX_SECURE_TLS_RSA_PREMASTER_SIZE; } /* End RSA-specific section. */ diff --git a/nx_secure/src/nx_secure_tls_process_clienthello.c b/nx_secure/src/nx_secure_tls_process_clienthello.c index cb2207d1..deaf3b49 100644 --- a/nx_secure/src/nx_secure_tls_process_clienthello.c +++ b/nx_secure/src/nx_secure_tls_process_clienthello.c @@ -36,7 +36,7 @@ static UINT _nx_secure_tls_check_ciphersuite(const NX_SECURE_TLS_CIPHERSUITE_INF /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_process_clienthello PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -85,6 +85,9 @@ static UINT _nx_secure_tls_check_ciphersuite(const NX_SECURE_TLS_CIPHERSUITE_INF /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), added */ +/* priority ciphersuite logic, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_tls_process_clienthello(NX_SECURE_TLS_SESSION *tls_session, UCHAR *packet_buffer, @@ -101,6 +104,8 @@ USHORT protocol_version; USHORT newest_version; UINT total_extensions_length; const NX_SECURE_TLS_CIPHERSUITE_INFO *ciphersuite_info; +USHORT ciphersuite_priority; +USHORT new_ciphersuite_priority = 0; NX_SECURE_TLS_HELLO_EXTENSION extension_data[NX_SECURE_TLS_HELLO_EXTENSIONS_MAX]; UINT num_extensions = NX_SECURE_TLS_HELLO_EXTENSIONS_MAX; UCHAR *ciphersuite_list; @@ -218,7 +223,7 @@ USHORT tls_1_3 = tls_session -> nx_secure_tls_1_3 tls_session -> nx_secure_tls_protocol_version = protocol_version; /* Save off the random value for key generation later. */ - NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random, &packet_buffer[length], NX_SECURE_TLS_RANDOM_SIZE); + NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random, &packet_buffer[length], NX_SECURE_TLS_RANDOM_SIZE); length += NX_SECURE_TLS_RANDOM_SIZE; /* Extract the session ID if there is one. */ @@ -234,7 +239,7 @@ USHORT tls_1_3 = tls_session -> nx_secure_tls_1_3 tls_session -> nx_secure_tls_session_id_length = session_id_length; if (session_id_length > 0) { - NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_session_id, &packet_buffer[length], session_id_length); + NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_session_id, &packet_buffer[length], session_id_length); length += session_id_length; } @@ -387,6 +392,9 @@ USHORT tls_1_3 = tls_session -> nx_secure_tls_1_3 } #endif /* NX_SECURE_ENABLE_ECC_CIPHERSUITE */ + /* Set our initial priority to the maximum value - the size of our ciphersuite crypto table. */ + ciphersuite_priority = (USHORT)(0xFFFFFFFF); + for (i = 0; i < ciphersuite_list_length; i += 2) { /* Loop through list of acceptable ciphersuites. */ @@ -401,17 +409,20 @@ USHORT tls_1_3 = tls_session -> nx_secure_tls_1_3 } #endif - status = _nx_secure_tls_ciphersuite_lookup(tls_session, cipher_entry, &ciphersuite_info); + /* Look up the ciphersuite in our crypto table, then check the priority of the chosen ciphersuite. */ + status = _nx_secure_tls_ciphersuite_lookup(tls_session, cipher_entry, &ciphersuite_info, &new_ciphersuite_priority); /* Save the first ciphersuite we find - assume cipher table is in priority order. */ - if (status == NX_SUCCESS && tls_session -> nx_secure_tls_session_ciphersuite == NX_NULL) + if ((status == NX_SUCCESS) && (new_ciphersuite_priority < ciphersuite_priority)) { #ifdef NX_SECURE_ENABLE_ECC_CIPHERSUITE if (NX_SUCCESS == _nx_secure_tls_check_ciphersuite(ciphersuite_info, cert, selected_curve, cert_curve_supported)) #endif /* NX_SECURE_ENABLE_ECC_CIPHERSUITE */ { - /* Save the ciphersuite but continue processing the entire list. */ + /* Save the ciphersuite and its priority but continue processing the entire list to see if there + is a better ciphersuite available. */ tls_session -> nx_secure_tls_session_ciphersuite = ciphersuite_info; + ciphersuite_priority = new_ciphersuite_priority; } } @@ -437,6 +448,7 @@ USHORT tls_1_3 = tls_session -> nx_secure_tls_1_3 return(NX_SECURE_TLS_INAPPROPRIATE_FALLBACK); } } + /* Continue searching client ciphersuite list to get highest-priority selection. */ } /* See if we found an acceptable ciphersuite. */ diff --git a/nx_secure/src/nx_secure_tls_process_clienthello_extensions.c b/nx_secure/src/nx_secure_tls_process_clienthello_extensions.c index 41bd99d5..d3ffa3a2 100644 --- a/nx_secure/src/nx_secure_tls_process_clienthello_extensions.c +++ b/nx_secure/src/nx_secure_tls_process_clienthello_extensions.c @@ -426,7 +426,7 @@ INT compare_value; /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_proc_clienthello_sec_sa_extension PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -465,6 +465,9 @@ INT compare_value; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), added */ +/* curve priority logic, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ #ifdef NX_SECURE_ENABLE_ECC_CIPHERSUITE @@ -482,6 +485,8 @@ const UCHAR *groups; USHORT group; USHORT groups_len; const NX_CRYPTO_METHOD *curve_method; +UINT curve_priority; +UINT new_curve_priority = 0; #if (NX_SECURE_TLS_TLS_1_3_ENABLED) NX_SECURE_TLS_ECC *ecc_info; UINT signature_algorithm_exist = NX_FALSE; @@ -502,7 +507,7 @@ UCHAR expected_signature = 0; if (cert_curve) { - status = _nx_secure_tls_find_curve_method(tls_session, cert_curve, &curve_method); + status = _nx_secure_tls_find_curve_method(tls_session, cert_curve, &curve_method, NX_NULL); if (status == NX_SUCCESS && curve_method != NX_NULL) { *cert_curve_supported = NX_TRUE; @@ -536,23 +541,30 @@ UCHAR expected_signature = 0; case NX_SECURE_TLS_EXTENSION_EC_GROUPS: groups = exts[i].nx_secure_tls_extension_data; groups_len = exts[i].nx_secure_tls_extension_data_length; + + /* Set our start priority to the size of our supported curves list (lowest priority). */ + curve_priority = tls_session -> nx_secure_tls_ecc.nx_secure_tls_ecc_supported_groups_count; + + /* Loop through curves sent by client. */ for (j = 0; j < groups_len; j += 2) { group = (USHORT)((groups[j] << 8) + groups[j + 1]); - status = _nx_secure_tls_find_curve_method(tls_session, group, &curve_method); + status = _nx_secure_tls_find_curve_method(tls_session, group, &curve_method, &new_curve_priority); - if (status == NX_CRYTPO_MISSING_ECC_CURVE) + if ((status == NX_CRYTPO_MISSING_ECC_CURVE) || (new_curve_priority > curve_priority)) { /* Keep searching list. */ continue; } + /* Found a higher-priority curve. */ if (status == NX_SUCCESS) { /* Found shared named curve. */ *selected_curve = group; + curve_priority = new_curve_priority; #if (NX_SECURE_TLS_TLS_1_3_ENABLED) if (tls_session -> nx_secure_tls_1_3 && @@ -572,12 +584,10 @@ UCHAR expected_signature = 0; /* Store selected ECDHE key data index. */ tls_session -> nx_secure_tls_key_material.nx_secure_tls_ecc_key_data_selected = k; - break; } } } #endif - break; } else { @@ -585,6 +595,7 @@ UCHAR expected_signature = 0; /* status is not NX_CRYTPO_MISSING_ECC_CURVE or NX_SUCCESS, return error. */ return(status); } + /* Continue searching our supported curves list until we find the highest-priority curve. */ } /* Reset status as we do not return NX_CRYTPO_MISSING_ECC_CURVE. */ @@ -847,7 +858,7 @@ NX_SECURE_TLS_ECC *ecc_info; } /* Get the curve method to initialize the remote public key data. */ - _nx_secure_tls_find_curve_method(tls_session, key_group, &curve_method); + _nx_secure_tls_find_curve_method(tls_session, key_group, &curve_method, NX_NULL); if (curve_method == NX_NULL) { @@ -1532,7 +1543,7 @@ NX_SECURE_TLS_PSK_STORE *psk_store; /* Save the handshake hash state. */ NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch, tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata, - tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata_size); + tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata_size); } /* Hash the ClientHello, adding the TLS record header. */ @@ -1554,7 +1565,7 @@ NX_SECURE_TLS_PSK_STORE *psk_store; { NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata, tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch, - tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata_size); + tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata_size); } /* Generate the binder for our selected PSK. */ @@ -1577,7 +1588,7 @@ NX_SECURE_TLS_PSK_STORE *psk_store; } /* Make sure the Client PSK is initialized for later key generation. */ - NX_SECURE_MEMCPY(tls_session->nx_secure_tls_credentials.nx_secure_tls_client_psk.nx_secure_tls_psk_data, psk_data, psk_length); + NX_SECURE_MEMCPY(tls_session->nx_secure_tls_credentials.nx_secure_tls_client_psk.nx_secure_tls_psk_data, psk_data, psk_length); tls_session->nx_secure_tls_credentials.nx_secure_tls_client_psk.nx_secure_tls_psk_data_size = psk_length; return(NX_SUCCESS); diff --git a/nx_secure/src/nx_secure_tls_process_encrypted_extensions.c b/nx_secure/src/nx_secure_tls_process_encrypted_extensions.c index 8fb9a5cc..01897d7a 100644 --- a/nx_secure/src/nx_secure_tls_process_encrypted_extensions.c +++ b/nx_secure/src/nx_secure_tls_process_encrypted_extensions.c @@ -30,7 +30,7 @@ /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_process_encrypted_extensions PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -63,6 +63,9 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), update */ +/* ciphersuite lookup method, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_tls_process_encrypted_extensions(NX_SECURE_TLS_SESSION *tls_session, diff --git a/nx_secure/src/nx_secure_tls_process_finished.c b/nx_secure/src/nx_secure_tls_process_finished.c index 396bc24f..9559fbf8 100644 --- a/nx_secure/src/nx_secure_tls_process_finished.c +++ b/nx_secure/src/nx_secure_tls_process_finished.c @@ -153,7 +153,7 @@ UINT is_server; #ifdef NX_SECURE_TLS_ENABLE_SECURE_RENEGOTIATION /* If we are doing secure renegotiation as per RFC 5746, we need to save off the generated verify data now. For TLS 1.0-1.2 this is 12 bytes. If SSLv3 is ever used, it will be 36 bytes. */ - NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_remote_verify_data, generated_hash, NX_SECURE_TLS_FINISHED_HASH_SIZE); + NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_remote_verify_data, generated_hash, NX_SECURE_TLS_FINISHED_HASH_SIZE); #endif /* The finished verify data is always 12 bytes (*except for SSLv3) - compare to see if the Finished hash matches the recevied hash. */ diff --git a/nx_secure/src/nx_secure_tls_process_newsessionticket.c b/nx_secure/src/nx_secure_tls_process_newsessionticket.c index d303c710..4e5ac140 100644 --- a/nx_secure/src/nx_secure_tls_process_newsessionticket.c +++ b/nx_secure/src/nx_secure_tls_process_newsessionticket.c @@ -199,7 +199,7 @@ NX_SECURE_TLS_PSK_STORE *ticket_psk; packet_buffer = &packet_buffer[ticket_len]; /* Copy ticket to PSK store - the ticket is the PSK ID used to identify the PSK in the future. */ - NX_SECURE_MEMCPY(ticket_psk->nx_secure_tls_psk_id, ticket, ticket_len); + NX_SECURE_MEMCPY(ticket_psk->nx_secure_tls_psk_id, ticket, ticket_len); ticket_psk->nx_secure_tls_psk_id_size = ticket_len; /* Add in extensions if available. */ diff --git a/nx_secure/src/nx_secure_tls_process_remote_certificate.c b/nx_secure/src/nx_secure_tls_process_remote_certificate.c index 72082eef..4d00d23a 100644 --- a/nx_secure/src/nx_secure_tls_process_remote_certificate.c +++ b/nx_secure/src/nx_secure_tls_process_remote_certificate.c @@ -210,7 +210,7 @@ ULONG cert_buf_size; /* Copy the certificate from the packet buffer into our allocated certificate space. */ certificate -> nx_secure_x509_certificate_raw_data_length = cert_length; - NX_SECURE_MEMCPY(certificate -> nx_secure_x509_certificate_raw_data, &packet_buffer[length], cert_length); + NX_SECURE_MEMCPY(certificate -> nx_secure_x509_certificate_raw_data, &packet_buffer[length], cert_length); } length += cert_length; @@ -349,7 +349,7 @@ ULONG cert_buf_size; /* Copy the certificate data to the end of the certificate buffer or use an allocated certificate. */ certificate -> nx_secure_x509_certificate_raw_data_length = endpoint_length; - NX_SECURE_MEMCPY(certificate->nx_secure_x509_certificate_raw_data, endpoint_raw_ptr, endpoint_length); + NX_SECURE_MEMCPY(certificate->nx_secure_x509_certificate_raw_data, endpoint_raw_ptr, endpoint_length); /* Release the protection. */ tx_mutex_put(&_nx_secure_tls_protection); diff --git a/nx_secure/src/nx_secure_tls_process_server_key_exchange.c b/nx_secure/src/nx_secure_tls_process_server_key_exchange.c index 8b2709f6..ce7754e7 100644 --- a/nx_secure/src/nx_secure_tls_process_server_key_exchange.c +++ b/nx_secure/src/nx_secure_tls_process_server_key_exchange.c @@ -38,7 +38,7 @@ static UCHAR decrypted_signature[512]; /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_process_server_key_exchange PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -80,6 +80,9 @@ static UCHAR decrypted_signature[512]; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), update */ +/* ECC find curve method, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_tls_process_server_key_exchange(NX_SECURE_TLS_SESSION *tls_session, @@ -156,7 +159,7 @@ UINT i; /* Extract the identity hint and save in the TLS Session. Then when pre-master is generated in client_handshake, we can do the right thing... */ - NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_credentials.nx_secure_tls_remote_psk_id, &packet_buffer[0], length); + NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_credentials.nx_secure_tls_remote_psk_id, &packet_buffer[0], length); tls_session -> nx_secure_tls_credentials.nx_secure_tls_remote_psk_id_size = length; return(NX_SECURE_TLS_SUCCESS); @@ -226,7 +229,7 @@ UINT i; } /* Find out which named curve the server is using. */ - status = _nx_secure_tls_find_curve_method(tls_session, (USHORT)((packet_buffer[1] << 8) + packet_buffer[2]), &curve_method); + status = _nx_secure_tls_find_curve_method(tls_session, (USHORT)((packet_buffer[1] << 8) + packet_buffer[2]), &curve_method, NX_NULL); if(status != NX_SUCCESS) { @@ -742,7 +745,7 @@ UINT i; ec_pubkey = &server_certificate -> nx_secure_x509_public_key.ec_public_key; /* Find out which named curve the remote certificate is using. */ - status = _nx_secure_tls_find_curve_method(tls_session, (USHORT)(ec_pubkey -> nx_secure_ec_named_curve), &curve_method_cert); + status = _nx_secure_tls_find_curve_method(tls_session, (USHORT)(ec_pubkey -> nx_secure_ec_named_curve), &curve_method_cert, NX_NULL); if(status != NX_SUCCESS) { diff --git a/nx_secure/src/nx_secure_tls_process_serverhello.c b/nx_secure/src/nx_secure_tls_process_serverhello.c index 73b458d0..d7a264d7 100644 --- a/nx_secure/src/nx_secure_tls_process_serverhello.c +++ b/nx_secure/src/nx_secure_tls_process_serverhello.c @@ -32,7 +32,7 @@ extern const UCHAR _nx_secure_tls_hello_retry_request_random[32]; /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_process_serverhello PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -73,6 +73,9 @@ extern const UCHAR _nx_secure_tls_hello_retry_request_random[32]; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), added */ +/* priority ciphersuite logic, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_tls_process_serverhello(NX_SECURE_TLS_SESSION *tls_session, UCHAR *packet_buffer, @@ -83,6 +86,7 @@ UCHAR compression_method; USHORT version, total_extensions_length; UINT status; USHORT ciphersuite; +USHORT ciphersuite_priority; NX_SECURE_TLS_HELLO_EXTENSION extension_data[NX_SECURE_TLS_HELLO_EXTENSIONS_MAX]; UINT num_extensions; #if (NX_SECURE_TLS_TLS_1_3_ENABLED) @@ -143,7 +147,7 @@ NX_SECURE_TLS_SERVER_STATE old_client_state = tls_session -> nx_secur { /* Set the Server random data, used in key generation. First 4 bytes is GMT time. */ - NX_SECURE_MEMCPY(&tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random[0], &packet_buffer[length], NX_SECURE_TLS_RANDOM_SIZE); + NX_SECURE_MEMCPY(&tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random[0], &packet_buffer[length], NX_SECURE_TLS_RANDOM_SIZE); } length += NX_SECURE_TLS_RANDOM_SIZE; @@ -159,7 +163,7 @@ NX_SECURE_TLS_SERVER_STATE old_client_state = tls_session -> nx_secur /* Session ID follows. */ if (tls_session -> nx_secure_tls_session_id_length > 0) { - NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_session_id, &packet_buffer[length], tls_session -> nx_secure_tls_session_id_length); + NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_session_id, &packet_buffer[length], tls_session -> nx_secure_tls_session_id_length); length += tls_session -> nx_secure_tls_session_id_length; } @@ -168,7 +172,7 @@ NX_SECURE_TLS_SERVER_STATE old_client_state = tls_session -> nx_secur length += 2; /* Find out the ciphersuite info of the chosen ciphersuite. */ - status = _nx_secure_tls_ciphersuite_lookup(tls_session, ciphersuite, &tls_session -> nx_secure_tls_session_ciphersuite); + status = _nx_secure_tls_ciphersuite_lookup(tls_session, ciphersuite, &tls_session -> nx_secure_tls_session_ciphersuite, &ciphersuite_priority); if (status != NX_SUCCESS) { #if (NX_SECURE_TLS_TLS_1_3_ENABLED) diff --git a/nx_secure/src/nx_secure_tls_process_serverhello_extensions.c b/nx_secure/src/nx_secure_tls_process_serverhello_extensions.c index 28c91b5b..007313f3 100644 --- a/nx_secure/src/nx_secure_tls_process_serverhello_extensions.c +++ b/nx_secure/src/nx_secure_tls_process_serverhello_extensions.c @@ -727,7 +727,7 @@ INT compare_value; /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_proc_serverhello_keyshare_extension PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -761,6 +761,9 @@ INT compare_value; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), update */ +/* ECC find curve method, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ #if (NX_SECURE_TLS_TLS_1_3_ENABLED) @@ -865,7 +868,7 @@ NX_SECURE_TLS_ECC *ecc_info; pubkey = &packet_buffer[offset]; /* Get the curve method to initialize the remote public key data. */ - _nx_secure_tls_find_curve_method(tls_session, key_group, &curve_method); + _nx_secure_tls_find_curve_method(tls_session, key_group, &curve_method, NX_NULL); if (curve_method == NX_NULL) { diff --git a/nx_secure/src/nx_secure_tls_psk_add.c b/nx_secure/src/nx_secure_tls_psk_add.c index 17fbb5bb..bcd7a3af 100644 --- a/nx_secure/src/nx_secure_tls_psk_add.c +++ b/nx_secure/src/nx_secure_tls_psk_add.c @@ -29,7 +29,7 @@ /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_psk_add PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -68,6 +68,9 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), improved */ +/* buffer length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ #if defined(NX_SECURE_ENABLE_PSK_CIPHERSUITES) || defined(NX_SECURE_ENABLE_ECJPAKE_CIPHERSUITE) @@ -86,18 +89,19 @@ UINT current_index; /* Make sure we have space to add the PSK and its identity data. */ if ((current_index + 1) < NX_SECURE_TLS_MAX_PSK_KEYS && psk_length < NX_SECURE_TLS_MAX_PSK_SIZE && - identity_length < NX_SECURE_TLS_MAX_PSK_ID_SIZE) + identity_length < NX_SECURE_TLS_MAX_PSK_ID_SIZE && + hint_length <= NX_SECURE_TLS_MAX_PSK_ID_SIZE) { /* Save off the PSK and its length. */ - NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_credentials.nx_secure_tls_psk_store[current_index].nx_secure_tls_psk_data, pre_shared_key, psk_length); + NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_credentials.nx_secure_tls_psk_store[current_index].nx_secure_tls_psk_data, pre_shared_key, psk_length); tls_session -> nx_secure_tls_credentials.nx_secure_tls_psk_store[current_index].nx_secure_tls_psk_data_size = psk_length; /* Save off the identity and its length. */ - NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_credentials.nx_secure_tls_psk_store[current_index].nx_secure_tls_psk_id, psk_identity, identity_length); + NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_credentials.nx_secure_tls_psk_store[current_index].nx_secure_tls_psk_id, psk_identity, identity_length); tls_session -> nx_secure_tls_credentials.nx_secure_tls_psk_store[current_index].nx_secure_tls_psk_id_size = identity_length; /* Save off the identity and its length. */ - NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_credentials.nx_secure_tls_psk_store[current_index].nx_secure_tls_psk_id_hint, hint, hint_length); + NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_credentials.nx_secure_tls_psk_store[current_index].nx_secure_tls_psk_id_hint, hint, hint_length); tls_session -> nx_secure_tls_credentials.nx_secure_tls_psk_store[current_index].nx_secure_tls_psk_id_hint_size = hint_length; /* Increment the session counter. */ diff --git a/nx_secure/src/nx_secure_tls_record_payload_decrypt.c b/nx_secure/src/nx_secure_tls_record_payload_decrypt.c index f2eddcd4..50f71e29 100644 --- a/nx_secure/src/nx_secure_tls_record_payload_decrypt.c +++ b/nx_secure/src/nx_secure_tls_record_payload_decrypt.c @@ -33,7 +33,7 @@ static UCHAR save_iv[20]; /* Must be large enough to hold the block size for ses /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_record_payload_decrypt PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -70,6 +70,9 @@ static UCHAR save_iv[20]; /* Must be large enough to hold the block size for ses /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), fixed */ +/* AES-CBC padding oracle, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_tls_record_payload_decrypt(NX_SECURE_TLS_SESSION *tls_session, UCHAR *data, @@ -176,7 +179,7 @@ UINT data_offset; nonce[0] = 12; /* Copy client_write_IV or server_write_IV. */ - NX_SECURE_MEMCPY(&nonce[1], iv, 12); + NX_SECURE_MEMCPY(&nonce[1], iv, 12); /* Correct the endianness of our sequence number and XOR with * the IV. Pad to the left with zeroes. */ @@ -251,7 +254,7 @@ UINT data_offset; nonce[0] = 12; /* Copy client_write_IV or server_write_IV. */ - NX_SECURE_MEMCPY(&nonce[1], iv, 4); + NX_SECURE_MEMCPY(&nonce[1], iv, 4); /* Correct the endianness of our sequence number before hashing. */ additional_data[0] = (UCHAR)(sequence_num[1] >> 24); @@ -264,7 +267,7 @@ UINT data_offset; additional_data[7] = (UCHAR)(sequence_num[0]); /* Copy nonce_explicit from the data. */ - NX_SECURE_MEMCPY(&nonce[5], data, 8); + NX_SECURE_MEMCPY(&nonce[5], data, 8); /* additional_data = seq_num + TLSCompressed.type + TLSCompressed.version + TLSCompressed.length; @@ -380,7 +383,7 @@ UINT data_offset; { /* Message length error. */ - return(NX_SECURE_TLS_INCORRECT_MESSAGE_LENGTH); + return(NX_SECURE_TLS_PADDING_CHECK_FAILED); } #if (NX_SECURE_TLS_TLS_1_0_ENABLED) @@ -390,14 +393,14 @@ UINT data_offset; if (session_cipher_method -> nx_crypto_algorithm == NX_CRYPTO_ENCRYPTION_AES_CBC) { /* New IV is the last encrypted block of the output. */ - NX_SECURE_MEMCPY(save_iv, &encrypted_data[*length - iv_size], iv_size); + NX_SECURE_MEMCPY(save_iv, &encrypted_data[*length - iv_size], iv_size); } } else /* TLS 1.1, 1.2 */ #endif { /* Copy IV from the beginning of the payload into our session buffer. */ - NX_SECURE_MEMCPY(iv, data, iv_size); + NX_SECURE_MEMCPY(iv, data, iv_size); /* Adjust payload length to account for IV that we saved off above. */ *length -= iv_size; @@ -466,7 +469,7 @@ UINT data_offset; { if (session_cipher_method -> nx_crypto_algorithm == NX_CRYPTO_ENCRYPTION_AES_CBC) { - NX_SECURE_MEMCPY(iv, save_iv, iv_size); + NX_SECURE_MEMCPY(iv, save_iv, iv_size); } } #endif diff --git a/nx_secure/src/nx_secure_tls_record_payload_encrypt.c b/nx_secure/src/nx_secure_tls_record_payload_encrypt.c index ea1b356d..87e704d4 100644 --- a/nx_secure/src/nx_secure_tls_record_payload_encrypt.c +++ b/nx_secure/src/nx_secure_tls_record_payload_encrypt.c @@ -187,7 +187,7 @@ VOID *crypto_method_metadata; /* New IV is the last encrypted block of the output. */ NX_SECURE_MEMCPY(iv, ¤t_packet -> nx_packet_prepend_ptr[current_length + data_offset - iv_size], - iv_size); + iv_size); } } } @@ -242,10 +242,10 @@ VOID *crypto_method_metadata; /* Offset for remainder bytes is rounded_length + data_offset. */ NX_SECURE_MEMCPY(&_nx_secure_tls_record_block_buffer[0], ¤t_packet -> nx_packet_prepend_ptr[rounded_length + data_offset], - remainder_length); + remainder_length); NX_SECURE_MEMCPY(&_nx_secure_tls_record_block_buffer[remainder_length], current_packet -> nx_packet_next -> nx_packet_prepend_ptr, - block_size - remainder_length); + block_size - remainder_length); /* Encrypt the remainder block. */ status = session_cipher_method -> nx_crypto_operation(NX_CRYPTO_ENCRYPT_UPDATE, @@ -273,17 +273,17 @@ VOID *crypto_method_metadata; /* Copy data from temporary buffer back into packets. */ NX_SECURE_MEMCPY(¤t_packet -> nx_packet_prepend_ptr[rounded_length + data_offset], - &_nx_secure_tls_record_block_buffer[0], remainder_length); + &_nx_secure_tls_record_block_buffer[0], remainder_length); NX_SECURE_MEMCPY(current_packet -> nx_packet_next -> nx_packet_prepend_ptr, &_nx_secure_tls_record_block_buffer[remainder_length], - block_size - remainder_length); + block_size - remainder_length); /* CBC-mode ciphers need to have their IV's updated after encryption. */ if (session_cipher_method -> nx_crypto_algorithm == NX_CRYPTO_ENCRYPTION_AES_CBC) { /* New IV is the last encrypted block of the output. */ - NX_SECURE_MEMCPY(iv, &_nx_secure_tls_record_block_buffer, iv_size); + NX_SECURE_MEMCPY(iv, &_nx_secure_tls_record_block_buffer, iv_size); } #ifdef NX_SECURE_KEY_CLEAR @@ -473,7 +473,7 @@ UINT message_length; nonce[0] = 12; /* Copy client_write_IV or server_write_IV. */ - NX_SECURE_MEMCPY(&nonce[1], iv, 12); + NX_SECURE_MEMCPY(&nonce[1], iv, 12); /* Correct the endianness of our sequence number and XOR with * the IV. Pad to the left with zeroes. */ @@ -538,7 +538,7 @@ UINT message_length; nonce[0] = 12; /* Copy client_write_IV or server_write_IV. */ - NX_SECURE_MEMCPY(&nonce[1], iv, 4); + NX_SECURE_MEMCPY(&nonce[1], iv, 4); /* Correct the endianness of our sequence number before hashing. */ nonce[5] = (UCHAR)(sequence_num[1] >> 24); @@ -554,7 +554,7 @@ UINT message_length; TLSCompressed.version + TLSCompressed.length; */ message_length = send_packet -> nx_packet_length - 8; - NX_SECURE_MEMCPY(additional_data, &nonce[5], 8); + NX_SECURE_MEMCPY(additional_data, &nonce[5], 8); additional_data[8] = record_type; additional_data[9] = (UCHAR)(tls_session -> nx_secure_tls_protocol_version >> 8); additional_data[10] = (UCHAR)(tls_session -> nx_secure_tls_protocol_version); @@ -565,7 +565,7 @@ UINT message_length; additional_data_size = 13; /* Copy our IV into our data buffer at the head of the payload. */ - NX_SECURE_MEMCPY(send_packet -> nx_packet_prepend_ptr, &nonce[5], 8); + NX_SECURE_MEMCPY(send_packet -> nx_packet_prepend_ptr, &nonce[5], 8); *data_offset = 8; } @@ -618,7 +618,7 @@ UINT message_length; /* IV size is equal to the AES block size. Copy our IV into our data buffer at the head of the payload. */ - NX_SECURE_MEMCPY(send_packet -> nx_packet_prepend_ptr, iv, iv_size); + NX_SECURE_MEMCPY(send_packet -> nx_packet_prepend_ptr, iv, iv_size); *data_offset = iv_size; } diff --git a/nx_secure/src/nx_secure_tls_send_certificate_verify.c b/nx_secure/src/nx_secure_tls_send_certificate_verify.c index cad11978..f504a3e1 100644 --- a/nx_secure/src/nx_secure_tls_send_certificate_verify.c +++ b/nx_secure/src/nx_secure_tls_send_certificate_verify.c @@ -40,7 +40,7 @@ static const UCHAR _NX_SECURE_OID_SHA256[] = {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09 /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_send_certificate_verify PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -84,6 +84,9 @@ static const UCHAR _NX_SECURE_OID_SHA256[] = {0x30, 0x31, 0x30, 0x0d, 0x06, 0x09 /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), update */ +/* ECC find curve method, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_tls_send_certificate_verify(NX_SECURE_TLS_SESSION *tls_session, @@ -232,16 +235,16 @@ NX_CRYPTO_EXTENDED_OUTPUT extended_output; if (tls_session -> nx_secure_tls_socket_type == NX_SECURE_TLS_SESSION_TYPE_CLIENT) { /* Copy in context string and 0-byte separator. */ - NX_SECURE_MEMCPY(&handshake_hash[64], client_context, 34); + NX_SECURE_MEMCPY(&handshake_hash[64], client_context, 34); } else { /* Copy in context string and 0-byte separator. */ - NX_SECURE_MEMCPY(&handshake_hash[64], server_context, 34); + NX_SECURE_MEMCPY(&handshake_hash[64], server_context, 34); } /* Copy in transcript hash. */ - NX_SECURE_MEMCPY(&handshake_hash[64 + 34], transcript_hash, 32); + NX_SECURE_MEMCPY(&handshake_hash[64 + 34], transcript_hash, 32); handshake_hash_length = 130; @@ -357,7 +360,7 @@ NX_CRYPTO_EXTENDED_OUTPUT extended_output; /* Copy over the handshake hash state into a local structure to do the intermediate calculation. */ NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch, tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata, - tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata_size); + tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata_size); /* Use SHA-256 for now... */ hash_method = tls_session -> nx_secure_tls_crypto_table -> nx_secure_tls_handshake_hash_sha256_method; @@ -401,11 +404,11 @@ NX_CRYPTO_EXTENDED_OUTPUT extended_output; first, then MD5. */ NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch, tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha1_metadata, - tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha1_metadata_size); + tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha1_metadata_size); NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch + tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha1_metadata_size, tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_md5_metadata, - tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_md5_metadata_size); + tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_md5_metadata_size); /* Finalize the handshake message hashes that we started at the beginning of the handshake. */ hash_method = tls_session -> nx_secure_tls_crypto_table -> nx_secure_tls_handshake_hash_md5_method; @@ -536,10 +539,10 @@ NX_CRYPTO_EXTENDED_OUTPUT extended_output; working_ptr = &_nx_secure_padded_signature[data_size - signature_length]; /* Copy in the DER encoding. */ - NX_SECURE_MEMCPY(&working_ptr[0], _NX_SECURE_OID_SHA256, 19); + NX_SECURE_MEMCPY(&working_ptr[0], _NX_SECURE_OID_SHA256, 19); /* Now put the data into the padded buffer - must be at the end. */ - NX_SECURE_MEMCPY(&working_ptr[19], handshake_hash, 32); + NX_SECURE_MEMCPY(&working_ptr[19], handshake_hash, 32); } #endif @@ -575,7 +578,7 @@ NX_CRYPTO_EXTENDED_OUTPUT extended_output; working_ptr = &_nx_secure_padded_signature[data_size - signature_length]; /* Now put the data into the padded buffer - must be at the end. */ - NX_SECURE_MEMCPY(working_ptr, handshake_hash, 36); + NX_SECURE_MEMCPY(working_ptr, handshake_hash, 36); } #endif @@ -745,7 +748,7 @@ NX_CRYPTO_EXTENDED_OUTPUT extended_output; ec_pubkey = &local_certificate -> nx_secure_x509_public_key.ec_public_key; /* Find out which named curve the local certificate is using. */ - status = _nx_secure_tls_find_curve_method(tls_session, (USHORT)(ec_privkey -> nx_secure_ec_named_curve), &curve_method_cert); + status = _nx_secure_tls_find_curve_method(tls_session, (USHORT)(ec_privkey -> nx_secure_ec_named_curve), &curve_method_cert, NX_NULL); #ifdef NX_SECURE_KEY_CLEAR if(status != NX_SUCCESS || curve_method_cert == NX_NULL) diff --git a/nx_secure/src/nx_secure_tls_send_client_key_exchange.c b/nx_secure/src/nx_secure_tls_send_client_key_exchange.c index 7e14eefb..3e113da9 100644 --- a/nx_secure/src/nx_secure_tls_send_client_key_exchange.c +++ b/nx_secure/src/nx_secure_tls_send_client_key_exchange.c @@ -123,7 +123,7 @@ NX_CRYPTO_EXTENDED_OUTPUT extended_output; return(NX_SECURE_TLS_PACKET_BUFFER_TOO_SMALL); } - NX_SECURE_MEMCPY(packet_buffer, tls_session -> nx_secure_tls_key_material.nx_secure_tls_new_key_material_data, data_size); + NX_SECURE_MEMCPY(packet_buffer, tls_session -> nx_secure_tls_key_material.nx_secure_tls_new_key_material_data, data_size); } else #endif /* NX_SECURE_ENABLE_ECC_CIPHERSUITE */ @@ -148,7 +148,7 @@ NX_CRYPTO_EXTENDED_OUTPUT extended_output; /* Send the PSK Identity string to the remote server along with its length. */ NX_SECURE_MEMCPY(encrypted_data_ptr, tls_session -> nx_secure_tls_credentials.nx_secure_tls_client_psk.nx_secure_tls_psk_id, - tls_session -> nx_secure_tls_credentials.nx_secure_tls_client_psk.nx_secure_tls_psk_id_size); + tls_session -> nx_secure_tls_credentials.nx_secure_tls_client_psk.nx_secure_tls_psk_id_size); /* Make sure our size is correct. */ data_size = tls_session -> nx_secure_tls_credentials.nx_secure_tls_client_psk.nx_secure_tls_psk_id_size; @@ -237,7 +237,7 @@ NX_CRYPTO_EXTENDED_OUTPUT extended_output; /* Now put the pre-master data into the padded buffer - must be at the end. */ NX_SECURE_MEMCPY(&_nx_secure_client_padded_pre_master[data_size - NX_SECURE_TLS_RSA_PREMASTER_SIZE], - tls_session -> nx_secure_tls_key_material.nx_secure_tls_pre_master_secret, NX_SECURE_TLS_RSA_PREMASTER_SIZE); + tls_session -> nx_secure_tls_key_material.nx_secure_tls_pre_master_secret, NX_SECURE_TLS_RSA_PREMASTER_SIZE); if (public_cipher_method -> nx_crypto_init != NX_NULL) { diff --git a/nx_secure/src/nx_secure_tls_send_clienthello.c b/nx_secure/src/nx_secure_tls_send_clienthello.c index d4e67293..881cf0c8 100644 --- a/nx_secure/src/nx_secure_tls_send_clienthello.c +++ b/nx_secure/src/nx_secure_tls_send_clienthello.c @@ -171,13 +171,13 @@ ULONG extension_length, total_extensions_length; gmt_time = tls_session -> nx_secure_tls_session_time_function(); } NX_CHANGE_ULONG_ENDIAN(gmt_time); - NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random, (UCHAR *)&gmt_time, sizeof(gmt_time)); + NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random, (UCHAR *)&gmt_time, sizeof(gmt_time)); #if (NX_SECURE_TLS_TLS_1_3_ENABLED) if (tls_session -> nx_secure_tls_client_state == NX_SECURE_TLS_CLIENT_STATE_HELLO_RETRY) { NX_SECURE_MEMCPY(&packet_buffer[length], tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random, - sizeof(tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random)); + sizeof(tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random)); } else #endif @@ -195,7 +195,7 @@ ULONG extension_length, total_extensions_length; /* Copy the random data into the packet. */ NX_SECURE_MEMCPY(&packet_buffer[length], tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random, - sizeof(tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random)); + sizeof(tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random)); } length += sizeof(tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_random); @@ -207,7 +207,7 @@ ULONG extension_length, total_extensions_length; /* Session ID follows. */ if (tls_session -> nx_secure_tls_session_id_length > 0) { - NX_SECURE_MEMCPY(&packet_buffer[length], tls_session -> nx_secure_tls_session_id, tls_session -> nx_secure_tls_session_id_length); + NX_SECURE_MEMCPY(&packet_buffer[length], tls_session -> nx_secure_tls_session_id, tls_session -> nx_secure_tls_session_id_length); length += tls_session -> nx_secure_tls_session_id_length; } diff --git a/nx_secure/src/nx_secure_tls_send_clienthello_extensions.c b/nx_secure/src/nx_secure_tls_send_clienthello_extensions.c index eb8545af..a09f7321 100644 --- a/nx_secure/src/nx_secure_tls_send_clienthello_extensions.c +++ b/nx_secure/src/nx_secure_tls_send_clienthello_extensions.c @@ -204,7 +204,7 @@ UINT status; length += 2; /* Add Cookie. */ - NX_SECURE_MEMCPY(&packet_buffer[length], tls_session -> nx_secure_tls_cookie, tls_session -> nx_secure_tls_cookie_length); + NX_SECURE_MEMCPY(&packet_buffer[length], tls_session -> nx_secure_tls_cookie, tls_session -> nx_secure_tls_cookie_length); length += (tls_session -> nx_secure_tls_cookie_length); /* Update total extensions length and reset the stored cookie length. */ @@ -780,7 +780,7 @@ USHORT named_curve; offset += 2; /* Set the key data from our already-generated ECC keys. */ - NX_SECURE_MEMCPY(&packet_buffer[offset], &tls_session -> nx_secure_tls_key_material.nx_secure_tls_ecc_key_data[entry_index].nx_secure_tls_ecdhe_public_key[0], key_length); + NX_SECURE_MEMCPY(&packet_buffer[offset], &tls_session -> nx_secure_tls_key_material.nx_secure_tls_ecc_key_data[entry_index].nx_secure_tls_ecdhe_public_key[0], key_length); offset += (key_length); /* Get the length of the entire extension. */ @@ -983,7 +983,7 @@ NX_SECURE_TLS_PSK_STORE *psk_store; offset += 2; /* Put the ID data into our packet. */ - NX_SECURE_MEMCPY(&packet_buffer[offset], id, id_len); + NX_SECURE_MEMCPY(&packet_buffer[offset], id, id_len); offset += (UINT)(id_len); /* Set the obfuscated PSK age. */ @@ -1059,7 +1059,7 @@ NX_SECURE_TLS_PSK_STORE *psk_store; /* Save the handshake hash state. */ NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch, tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata, - tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata_size); + tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata_size); } /* Hash the ClientHello up to its current point. */ @@ -1083,7 +1083,7 @@ NX_SECURE_TLS_PSK_STORE *psk_store; { NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata, tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_scratch, - tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata_size); + tls_session -> nx_secure_tls_handshake_hash.nx_secure_tls_handshake_hash_sha256_metadata_size); } /* Loop through all IDs and set the binders accordingly. */ @@ -1122,7 +1122,7 @@ NX_SECURE_TLS_PSK_STORE *psk_store; offset += (UINT)(1); /* Put the binder data into the packet. */ - NX_SECURE_MEMCPY(&packet_buffer[offset], binder, binder_len); + NX_SECURE_MEMCPY(&packet_buffer[offset], binder, binder_len); offset += (UINT)(binder_len); /* Update our total with the binder length (binder_len) and length field(1). */ @@ -1386,7 +1386,7 @@ UINT data_length; offset += 2; /* Write the name into the packet. */ - NX_SECURE_MEMCPY(&packet_buffer[offset], tls_session -> nx_secure_tls_sni_extension_server_name -> nx_secure_x509_dns_name, data_length); + NX_SECURE_MEMCPY(&packet_buffer[offset], tls_session -> nx_secure_tls_sni_extension_server_name -> nx_secure_x509_dns_name, data_length); offset += data_length; /* Return the amount of data we wrote. */ @@ -1557,7 +1557,7 @@ UINT data_length; offset++; /* Copy the verify data into the packet. */ - NX_SECURE_MEMCPY(&packet_buffer[offset], tls_session -> nx_secure_tls_local_verify_data, NX_SECURE_TLS_FINISHED_HASH_SIZE); + NX_SECURE_MEMCPY(&packet_buffer[offset], tls_session -> nx_secure_tls_local_verify_data, NX_SECURE_TLS_FINISHED_HASH_SIZE); offset += NX_SECURE_TLS_FINISHED_HASH_SIZE; } diff --git a/nx_secure/src/nx_secure_tls_send_encrypted_extensions.c b/nx_secure/src/nx_secure_tls_send_encrypted_extensions.c index aee393f3..3de7b42e 100644 --- a/nx_secure/src/nx_secure_tls_send_encrypted_extensions.c +++ b/nx_secure/src/nx_secure_tls_send_encrypted_extensions.c @@ -63,6 +63,8 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), update */ +/* ciphersuite lookup method. */ /* */ /**************************************************************************/ UINT _nx_secure_tls_send_encrypted_extensions(NX_SECURE_TLS_SESSION *tls_session, NX_PACKET *send_packet) diff --git a/nx_secure/src/nx_secure_tls_send_finished.c b/nx_secure/src/nx_secure_tls_send_finished.c index 9d3e0fc7..63e15615 100644 --- a/nx_secure/src/nx_secure_tls_send_finished.c +++ b/nx_secure/src/nx_secure_tls_send_finished.c @@ -115,7 +115,7 @@ UINT is_server; #ifdef NX_SECURE_TLS_ENABLE_SECURE_RENEGOTIATION /* If we are doing secure renegotiation as per RFC 5746, we need to save off the generated verify data now. For TLS 1.0-1.2 this is 12 bytes. If SSLv3 is ever used, it will be 36 bytes. */ - NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_local_verify_data, send_packet -> nx_packet_append_ptr, NX_SECURE_TLS_FINISHED_HASH_SIZE); + NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_local_verify_data, send_packet -> nx_packet_append_ptr, NX_SECURE_TLS_FINISHED_HASH_SIZE); #endif /* The finished verify data is always 12 bytes for TLS 1.2 and earlier. */ diff --git a/nx_secure/src/nx_secure_tls_send_handshake_record.c b/nx_secure/src/nx_secure_tls_send_handshake_record.c index 43273050..e0eda93f 100644 --- a/nx_secure/src/nx_secure_tls_send_handshake_record.c +++ b/nx_secure/src/nx_secure_tls_send_handshake_record.c @@ -135,7 +135,7 @@ UINT buffer_offset; #endif /* (NX_SECURE_TLS_TLS_1_3_ENABLED) */ { NX_SECURE_MEMCPY(&tls_session->nx_secure_tls_key_material.nx_secure_tls_handshake_cache[buffer_offset], - current_packet -> nx_packet_prepend_ptr, (UINT)length); + current_packet -> nx_packet_prepend_ptr, (UINT)length); /* Advance the length. */ buffer_offset += (UINT)length; diff --git a/nx_secure/src/nx_secure_tls_send_newsessionticket.c b/nx_secure/src/nx_secure_tls_send_newsessionticket.c index 8dd8ea0c..eb49f42a 100644 --- a/nx_secure/src/nx_secure_tls_send_newsessionticket.c +++ b/nx_secure/src/nx_secure_tls_send_newsessionticket.c @@ -205,7 +205,7 @@ UCHAR *packet_buffer; length += 2; /* Copy in ticket. */ - NX_SECURE_MEMCPY(&packet_buffer[length], ticket, ticket_len); + NX_SECURE_MEMCPY(&packet_buffer[length], ticket, ticket_len); length += ticket_len; /* Add in extensions if available. */ diff --git a/nx_secure/src/nx_secure_tls_send_record.c b/nx_secure/src/nx_secure_tls_send_record.c index 8deb2938..37991350 100644 --- a/nx_secure/src/nx_secure_tls_send_record.c +++ b/nx_secure/src/nx_secure_tls_send_record.c @@ -29,7 +29,7 @@ /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_send_record PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -80,6 +80,10 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), and */ +/* fixed race condition for */ +/* multithread transmission, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_tls_send_record(NX_SECURE_TLS_SESSION *tls_session, NX_PACKET *send_packet, @@ -100,6 +104,29 @@ NX_PACKET *current_packet; /* Length of the data in the packet. */ length = send_packet -> nx_packet_length; + if ((tls_session -> nx_secure_tls_tcp_socket) && + (tls_session -> nx_secure_tls_tcp_socket -> nx_tcp_socket_ip_ptr) && + (tx_thread_identify() == &(tls_session -> nx_secure_tls_tcp_socket -> nx_tcp_socket_ip_ptr -> nx_ip_thread))) + { + + /* No wait is allowed for IP thread to avoid dead lock. */ + wait_option = 0; + } + + tx_mutex_put(&_nx_secure_tls_protection); + + /* Get transmit mutex first. */ + status = tx_mutex_get(&(tls_session -> nx_secure_tls_session_transmit_mutex), wait_option); + + tx_mutex_get(&_nx_secure_tls_protection, TX_WAIT_FOREVER); + + if (status) + { + + /* Unable to send due to another thread is still transmitting. */ + return(NX_SECURE_TLS_TRANSMIT_LOCKED); + } + /* See if this is an active session, we need to account for the IV if the session cipher uses one. TLS 1.3 does not use an explicit IV so don't add it.*/ if (tls_session -> nx_secure_tls_local_session_active @@ -114,6 +141,7 @@ NX_PACKET *current_packet; if (status != NX_SUCCESS) { + tx_mutex_put(&(tls_session -> nx_secure_tls_session_transmit_mutex)); return(status); } @@ -122,6 +150,7 @@ NX_PACKET *current_packet; { /* Return an invalid packet error. */ + tx_mutex_put(&(tls_session -> nx_secure_tls_session_transmit_mutex)); return(NX_SECURE_TLS_INVALID_PACKET); } @@ -140,6 +169,7 @@ NX_PACKET *current_packet; { /* Return an invalid packet error. */ + tx_mutex_put(&(tls_session -> nx_secure_tls_session_transmit_mutex)); return(NX_SECURE_TLS_INVALID_PACKET); } @@ -171,6 +201,7 @@ NX_PACKET *current_packet; { /* Likely internal error since at this point ciphersuite negotiation was theoretically completed. */ + tx_mutex_put(&(tls_session -> nx_secure_tls_session_transmit_mutex)); return(NX_SECURE_TLS_UNKNOWN_CIPHERSUITE); } @@ -184,6 +215,7 @@ NX_PACKET *current_packet; if(status != NX_SUCCESS) { + tx_mutex_put(&(tls_session -> nx_secure_tls_session_transmit_mutex)); return(status); } @@ -227,6 +259,7 @@ NX_PACKET *current_packet; /* Check return from hash routine initialization. */ if (status != NX_SUCCESS) { + tx_mutex_put(&(tls_session -> nx_secure_tls_session_transmit_mutex)); return(status); } @@ -276,6 +309,7 @@ NX_PACKET *current_packet; if (status != NX_SUCCESS) { + tx_mutex_put(&(tls_session -> nx_secure_tls_session_transmit_mutex)); return(status); } @@ -327,6 +361,9 @@ NX_PACKET *current_packet; /* Get the protection after nx_tcp_socket_send. */ tx_mutex_get(&_nx_secure_tls_protection, TX_WAIT_FOREVER); + /* Release transmit mutex. */ + tx_mutex_put(&(tls_session -> nx_secure_tls_session_transmit_mutex)); + return(status); } diff --git a/nx_secure/src/nx_secure_tls_send_server_key_exchange.c b/nx_secure/src/nx_secure_tls_send_server_key_exchange.c index d8552cd1..1a88fd70 100644 --- a/nx_secure/src/nx_secure_tls_send_server_key_exchange.c +++ b/nx_secure/src/nx_secure_tls_send_server_key_exchange.c @@ -142,7 +142,7 @@ NX_SECURE_TLS_ECDHE_HANDSHAKE_DATA *ecdhe_data; length = (USHORT)(length + 2); /* Extract the identity hint and put it into the packet buffer. */ - NX_SECURE_MEMCPY(&packet_buffer[length], identity, identity_length); + NX_SECURE_MEMCPY(&packet_buffer[length], identity, identity_length); /* Advance our total length. */ length = (USHORT)(length + identity_length); diff --git a/nx_secure/src/nx_secure_tls_send_serverhello.c b/nx_secure/src/nx_secure_tls_send_serverhello.c index 7dbf778c..04627083 100644 --- a/nx_secure/src/nx_secure_tls_send_serverhello.c +++ b/nx_secure/src/nx_secure_tls_send_serverhello.c @@ -47,7 +47,7 @@ const UCHAR _nx_secure_tls_1_1_random[8] = /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_send_serverhello PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -81,6 +81,9 @@ const UCHAR _nx_secure_tls_1_1_random[8] = /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), improved */ +/* buffer length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_tls_send_serverhello(NX_SECURE_TLS_SESSION *tls_session, NX_PACKET *send_packet) @@ -130,14 +133,14 @@ UINT status; } NX_CHANGE_ULONG_ENDIAN(gmt_time); - NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random, (UCHAR *)&gmt_time, sizeof(gmt_time)); + NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random, (UCHAR *)&gmt_time, sizeof(gmt_time)); #if (NX_SECURE_TLS_TLS_1_3_ENABLED) if (tls_session -> nx_secure_tls_server_state == NX_SECURE_TLS_SERVER_STATE_SEND_HELLO_RETRY) { NX_SECURE_MEMCPY(tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random, _nx_secure_tls_hello_retry_request_random, - sizeof(_nx_secure_tls_hello_retry_request_random)); + sizeof(_nx_secure_tls_hello_retry_request_random)); } else if (!(tls_session -> nx_secure_tls_1_3) && !(tls_session -> nx_secure_tls_protocol_version_override)) { @@ -158,13 +161,13 @@ UINT status; { NX_SECURE_MEMCPY(&(tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random[24]), _nx_secure_tls_1_2_random, - sizeof(_nx_secure_tls_1_2_random)); + sizeof(_nx_secure_tls_1_2_random)); } else { NX_SECURE_MEMCPY(&(tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random[24]), _nx_secure_tls_1_1_random, - sizeof(_nx_secure_tls_1_1_random)); + sizeof(_nx_secure_tls_1_1_random)); } } else @@ -184,7 +187,7 @@ UINT status; /* Copy the random data into the packet. */ NX_SECURE_MEMCPY(&packet_buffer[length], tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random, - sizeof(tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random)); + sizeof(tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random)); length += sizeof(tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_random); /* Session ID length is one byte. Session ID data follows if we ever implement session resumption. */ @@ -197,8 +200,15 @@ UINT status; packet_buffer[length] = tls_session->nx_secure_tls_session_id_length; length++; + if ((length + tls_session->nx_secure_tls_session_id_length + 3) > + ((ULONG)(send_packet -> nx_packet_data_end) - (ULONG)(send_packet -> nx_packet_append_ptr))) + { + + /* Packet buffer is too small to hold random. */ + return(NX_SECURE_TLS_PACKET_BUFFER_TOO_SMALL); + } - NX_SECURE_MEMCPY(&packet_buffer[length], tls_session -> nx_secure_tls_session_id, tls_session->nx_secure_tls_session_id_length); + NX_SECURE_MEMCPY(&packet_buffer[length], tls_session -> nx_secure_tls_session_id, tls_session->nx_secure_tls_session_id_length); length += tls_session->nx_secure_tls_session_id_length; } else diff --git a/nx_secure/src/nx_secure_tls_send_serverhello_extensions.c b/nx_secure/src/nx_secure_tls_send_serverhello_extensions.c index 2d2165de..f5102850 100644 --- a/nx_secure/src/nx_secure_tls_send_serverhello_extensions.c +++ b/nx_secure/src/nx_secure_tls_send_serverhello_extensions.c @@ -212,7 +212,7 @@ UINT status = NX_SUCCESS; /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_send_serverhello_sec_reneg_extension PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -249,6 +249,9 @@ UINT status = NX_SUCCESS; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), improved */ +/* buffer length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ #ifdef NX_SECURE_TLS_ENABLE_SECURE_RENEGOTIATION @@ -333,7 +336,7 @@ UINT data_length; else { /* Fill in the length of current extension. */ - if (available_size < (offset + 3u + NX_SECURE_TLS_FINISHED_HASH_SIZE)) + if (available_size < (offset + 3u + 2 * NX_SECURE_TLS_FINISHED_HASH_SIZE)) { /* Packet buffer too small. */ @@ -351,9 +354,9 @@ UINT data_length; offset++; /* Copy the verify data into the packet. */ - NX_SECURE_MEMCPY(&packet_buffer[offset], tls_session -> nx_secure_tls_remote_verify_data, NX_SECURE_TLS_FINISHED_HASH_SIZE); + NX_SECURE_MEMCPY(&packet_buffer[offset], tls_session -> nx_secure_tls_remote_verify_data, NX_SECURE_TLS_FINISHED_HASH_SIZE); offset += NX_SECURE_TLS_FINISHED_HASH_SIZE; - NX_SECURE_MEMCPY(&packet_buffer[offset], tls_session -> nx_secure_tls_local_verify_data, NX_SECURE_TLS_FINISHED_HASH_SIZE); + NX_SECURE_MEMCPY(&packet_buffer[offset], tls_session -> nx_secure_tls_local_verify_data, NX_SECURE_TLS_FINISHED_HASH_SIZE); offset += NX_SECURE_TLS_FINISHED_HASH_SIZE; } @@ -681,7 +684,7 @@ USHORT named_curve; offset += 2; /* Set the key data from our already-generated ECC keys. */ - NX_SECURE_MEMCPY(&packet_buffer[offset], &ecdhe_data->nx_secure_tls_ecdhe_public_key[0], key_length); + NX_SECURE_MEMCPY(&packet_buffer[offset], &ecdhe_data->nx_secure_tls_ecdhe_public_key[0], key_length); offset += (key_length); /* Get the length of the entire extension. */ diff --git a/nx_secure/src/nx_secure_tls_session_create_ext.c b/nx_secure/src/nx_secure_tls_session_create_ext.c index 4e1c77f7..1d11ef7d 100644 --- a/nx_secure/src/nx_secure_tls_session_create_ext.c +++ b/nx_secure/src/nx_secure_tls_session_create_ext.c @@ -29,7 +29,7 @@ /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_session_create_ext PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -76,6 +76,10 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), and */ +/* fixed race condition for */ +/* multithread transmission, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ @@ -493,7 +497,7 @@ const NX_CRYPTO_METHOD *crypto_method_sha256; /* Get a working pointer to the metadata buffer. */ metadata_area = (CHAR*)metadata_buffer; - if(tls_session->nx_secure_tls_crypto_table != NX_NULL) + if((crypto_array == NX_NULL) || (cipher_map == NX_NULL)) { /* Coming from the old-style API. Don't allocate crypto table. */ @@ -815,6 +819,9 @@ const NX_CRYPTO_METHOD *crypto_method_sha256; /* Set ID to check initialization status. */ tls_session -> nx_secure_tls_id = NX_SECURE_TLS_ID; + /* Create the mutex used for TLS session while transmitting packets. */ + tx_mutex_create(&(tls_session -> nx_secure_tls_session_transmit_mutex), "TLS transmit mutex", TX_NO_INHERIT); + /* Release the protection. */ tx_mutex_put(&_nx_secure_tls_protection); diff --git a/nx_secure/src/nx_secure_tls_session_delete.c b/nx_secure/src/nx_secure_tls_session_delete.c index 7ac3eeca..9f0bdad0 100644 --- a/nx_secure/src/nx_secure_tls_session_delete.c +++ b/nx_secure/src/nx_secure_tls_session_delete.c @@ -29,7 +29,7 @@ /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_session_delete PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -63,6 +63,10 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), and */ +/* fixed race condition for */ +/* multithread transmission, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_tls_session_delete(NX_SECURE_TLS_SESSION *tls_session) @@ -109,6 +113,9 @@ UINT status; /* Make sure the session is completely reset - set ID to zero for error checking. */ tls_session -> nx_secure_tls_id = 0; + /* Delete the mutex used for TLS session while transmitting packets. */ + tx_mutex_delete(&(tls_session -> nx_secure_tls_session_transmit_mutex)); + /* Release the protection. */ tx_mutex_put(&_nx_secure_tls_protection); diff --git a/nx_secure/src/nx_secure_tls_session_keys_set.c b/nx_secure/src/nx_secure_tls_session_keys_set.c index 3979f2be..130ce1c1 100644 --- a/nx_secure/src/nx_secure_tls_session_keys_set.c +++ b/nx_secure/src/nx_secure_tls_session_keys_set.c @@ -155,7 +155,7 @@ const NX_CRYPTO_METHOD *session_cipher_method = NX_NULL; if (is_client) { NX_SECURE_MEMCPY(&tls_session -> nx_secure_tls_key_material.nx_secure_tls_key_material_data[key_offset], - &tls_session -> nx_secure_tls_key_material.nx_secure_tls_new_key_material_data[key_offset], hash_size); + &tls_session -> nx_secure_tls_key_material.nx_secure_tls_new_key_material_data[key_offset], hash_size); } tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_write_mac_secret = &key_block[key_offset]; key_offset += hash_size; @@ -164,7 +164,7 @@ const NX_CRYPTO_METHOD *session_cipher_method = NX_NULL; if (!is_client) { NX_SECURE_MEMCPY(&tls_session -> nx_secure_tls_key_material.nx_secure_tls_key_material_data[key_offset], - &tls_session -> nx_secure_tls_key_material.nx_secure_tls_new_key_material_data[key_offset], hash_size); + &tls_session -> nx_secure_tls_key_material.nx_secure_tls_new_key_material_data[key_offset], hash_size); } tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_write_mac_secret = &key_block[key_offset]; key_offset += hash_size; @@ -177,7 +177,7 @@ const NX_CRYPTO_METHOD *session_cipher_method = NX_NULL; if (is_client) { NX_SECURE_MEMCPY(&tls_session -> nx_secure_tls_key_material.nx_secure_tls_key_material_data[key_offset], - &tls_session -> nx_secure_tls_key_material.nx_secure_tls_new_key_material_data[key_offset], key_size); + &tls_session -> nx_secure_tls_key_material.nx_secure_tls_new_key_material_data[key_offset], key_size); } tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_write_key = &key_block[key_offset]; key_offset += key_size; @@ -186,7 +186,7 @@ const NX_CRYPTO_METHOD *session_cipher_method = NX_NULL; if (!is_client) { NX_SECURE_MEMCPY(&tls_session -> nx_secure_tls_key_material.nx_secure_tls_key_material_data[key_offset], - &tls_session -> nx_secure_tls_key_material.nx_secure_tls_new_key_material_data[key_offset], key_size); + &tls_session -> nx_secure_tls_key_material.nx_secure_tls_new_key_material_data[key_offset], key_size); } tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_write_key = &key_block[key_offset]; key_offset += key_size; @@ -199,7 +199,7 @@ const NX_CRYPTO_METHOD *session_cipher_method = NX_NULL; if (is_client) { NX_SECURE_MEMCPY(&tls_session -> nx_secure_tls_key_material.nx_secure_tls_key_material_data[key_offset], - &tls_session -> nx_secure_tls_key_material.nx_secure_tls_new_key_material_data[key_offset], iv_size); + &tls_session -> nx_secure_tls_key_material.nx_secure_tls_new_key_material_data[key_offset], iv_size); } tls_session -> nx_secure_tls_key_material.nx_secure_tls_client_iv = &key_block[key_offset]; key_offset += iv_size; @@ -208,7 +208,7 @@ const NX_CRYPTO_METHOD *session_cipher_method = NX_NULL; if (!is_client) { NX_SECURE_MEMCPY(&tls_session -> nx_secure_tls_key_material.nx_secure_tls_key_material_data[key_offset], - &tls_session -> nx_secure_tls_key_material.nx_secure_tls_new_key_material_data[key_offset], iv_size); + &tls_session -> nx_secure_tls_key_material.nx_secure_tls_new_key_material_data[key_offset], iv_size); } tls_session -> nx_secure_tls_key_material.nx_secure_tls_server_iv = &key_block[key_offset]; key_offset += iv_size; diff --git a/nx_secure/src/nx_secure_tls_session_sni_extension_parse.c b/nx_secure/src/nx_secure_tls_session_sni_extension_parse.c index e314ee3d..584db171 100644 --- a/nx_secure/src/nx_secure_tls_session_sni_extension_parse.c +++ b/nx_secure/src/nx_secure_tls_session_sni_extension_parse.c @@ -129,7 +129,7 @@ UINT offset; } /* Name and lengths check out, save off the name data. */ - NX_SECURE_MEMCPY(dns_name -> nx_secure_x509_dns_name, &data_ptr[offset], dns_name -> nx_secure_x509_dns_name_length); + NX_SECURE_MEMCPY(dns_name -> nx_secure_x509_dns_name, &data_ptr[offset], dns_name -> nx_secure_x509_dns_name_length); /* Success! */ return(NX_SUCCESS); diff --git a/nx_secure/src/nx_secure_tls_verify_mac.c b/nx_secure/src/nx_secure_tls_verify_mac.c index 4eb3dfce..a5e25f68 100644 --- a/nx_secure/src/nx_secure_tls_verify_mac.c +++ b/nx_secure/src/nx_secure_tls_verify_mac.c @@ -31,7 +31,7 @@ static UCHAR _generated_hash[NX_SECURE_TLS_MAX_HASH_SIZE]; /* FUNCTION RELEASE */ /* */ /* _nx_secure_tls_verify_mac PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -69,6 +69,9 @@ static UCHAR _generated_hash[NX_SECURE_TLS_MAX_HASH_SIZE]; /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), fixed */ +/* AES-CBC padding oracle, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_tls_verify_mac(NX_SECURE_TLS_SESSION *tls_session, UCHAR *header_data, @@ -129,7 +132,7 @@ UCHAR header[6]; } /* The record data was smaller than the selected hash... Error. */ - return(NX_SECURE_TLS_INCORRECT_MESSAGE_LENGTH); + return(NX_SECURE_TLS_HASH_MAC_VERIFY_FAILURE); } /* Adjust our length so we only hash the record data, not the hash as well. */ @@ -140,7 +143,7 @@ UCHAR header[6]; { return(NX_SECURE_TLS_HASH_MAC_VERIFY_FAILURE); } - NX_SECURE_MEMCPY(header, header_data, header_length); + NX_SECURE_MEMCPY(header, header_data, header_length); /* Adjust the length in the header to match the length of the data before the hash was added. */ header[3] = (UCHAR)((data_length >> 8) & 0x00FF); diff --git a/nx_secure/src/nx_secure_x509_certificate_initialize.c b/nx_secure/src/nx_secure_x509_certificate_initialize.c index 55c543fb..514b75db 100644 --- a/nx_secure/src/nx_secure_x509_certificate_initialize.c +++ b/nx_secure/src/nx_secure_x509_certificate_initialize.c @@ -136,7 +136,7 @@ NX_SECURE_EC_PRIVATE_KEY *ec_key; /* Use the caller-supplied buffer for the certificate. */ certificate -> nx_secure_x509_certificate_raw_buffer_size = buffer_size; certificate -> nx_secure_x509_certificate_raw_data = raw_data_buffer; - NX_SECURE_MEMCPY(certificate -> nx_secure_x509_certificate_raw_data, certificate_data, length); + NX_SECURE_MEMCPY(certificate -> nx_secure_x509_certificate_raw_data, certificate_data, length); } /* Parse the DER-encoded X509 certificate to extract the public key data. diff --git a/nx_secure/src/nx_secure_x509_certificate_verify.c b/nx_secure/src/nx_secure_x509_certificate_verify.c index 7e63ddb6..ddfc2e27 100644 --- a/nx_secure/src/nx_secure_x509_certificate_verify.c +++ b/nx_secure/src/nx_secure_x509_certificate_verify.c @@ -35,7 +35,7 @@ static UCHAR decrypted_signature[512]; /* This needs to hold the entire decrypte /* FUNCTION RELEASE */ /* */ /* _nx_secure_x509_certificate_verify PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -75,6 +75,9 @@ static UCHAR decrypted_signature[512]; /* This needs to hold the entire decrypte /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), update */ +/* ECC find curve method, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_x509_certificate_verify(NX_SECURE_X509_CERTIFICATE_STORE *store, @@ -306,7 +309,7 @@ const NX_CRYPTO_METHOD *curve_method; ec_pubkey = &issuer_certificate -> nx_secure_x509_public_key.ec_public_key; /* Find out which named curve the remote certificate is using. */ - status = _nx_secure_tls_find_curve_method(NX_NULL, (USHORT)(ec_pubkey -> nx_secure_ec_named_curve), &curve_method); + status = _nx_secure_tls_find_curve_method(NX_NULL, (USHORT)(ec_pubkey -> nx_secure_ec_named_curve), &curve_method, NX_NULL); #ifdef NX_SECURE_KEY_CLEAR if(status != NX_SUCCESS || curve_method == NX_NULL) diff --git a/nx_secure/src/nx_secure_x509_crl_verify.c b/nx_secure/src/nx_secure_x509_crl_verify.c index 2e50edac..02b9adf1 100644 --- a/nx_secure/src/nx_secure_x509_crl_verify.c +++ b/nx_secure/src/nx_secure_x509_crl_verify.c @@ -35,7 +35,7 @@ static UCHAR decrypted_signature[512]; /* This needs to hold the entire decrypte /* FUNCTION RELEASE */ /* */ /* _nx_secure_x509_crl_verify PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -78,6 +78,9 @@ static UCHAR decrypted_signature[512]; /* This needs to hold the entire decrypte /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), update */ +/* ECC find curve method, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_x509_crl_verify(NX_SECURE_X509_CERT *certificate, NX_SECURE_X509_CRL *crl, @@ -307,7 +310,7 @@ const NX_CRYPTO_METHOD *curve_method; ec_pubkey = &issuer_certificate -> nx_secure_x509_public_key.ec_public_key; /* Find out which named curve the remote certificate is using. */ - status = _nx_secure_tls_find_curve_method(NX_NULL, (USHORT)(ec_pubkey -> nx_secure_ec_named_curve), &curve_method); + status = _nx_secure_tls_find_curve_method(NX_NULL, (USHORT)(ec_pubkey -> nx_secure_ec_named_curve), &curve_method, NX_NULL); #ifdef NX_SECURE_KEY_CLEAR if(status != NX_SUCCESS || curve_method == NX_NULL) diff --git a/nx_secure/src/nx_secure_x509_dns_name_initialize.c b/nx_secure/src/nx_secure_x509_dns_name_initialize.c index 7ed31d2f..5be5289e 100644 --- a/nx_secure/src/nx_secure_x509_dns_name_initialize.c +++ b/nx_secure/src/nx_secure_x509_dns_name_initialize.c @@ -33,7 +33,7 @@ /* FUNCTION RELEASE */ /* */ /* _nx_secure_x509_dns_name_initialize PORTABLE C */ -/* 6.0 */ +/* 6.0.1 */ /* AUTHOR */ /* */ /* Timothy Stapko, Microsoft Corporation */ @@ -66,14 +66,23 @@ /* DATE NAME DESCRIPTION */ /* */ /* 05-19-2020 Timothy Stapko Initial Version 6.0 */ +/* 06-30-2020 Timothy Stapko Modified comment(s), improved */ +/* buffer length verification, */ +/* resulting in version 6.0.1 */ /* */ /**************************************************************************/ UINT _nx_secure_x509_dns_name_initialize(NX_SECURE_X509_DNS_NAME *dns_name, const UCHAR *name_string, USHORT length) { + /* Make sure we don't copy over the end of the buffer. */ + if (dns_name -> nx_secure_x509_dns_name_length > NX_SECURE_X509_DNS_NAME_MAX) + { + dns_name -> nx_secure_x509_dns_name_length = NX_SECURE_X509_DNS_NAME_MAX; + } + /* Copy the name string into the entry structure. */ - NX_SECURE_MEMCPY(dns_name -> nx_secure_x509_dns_name, name_string, length); + NX_SECURE_MEMCPY(dns_name -> nx_secure_x509_dns_name, name_string, length); dns_name -> nx_secure_x509_dns_name_length = length; |