Manuel Pégourié-Gonnard 731d7c0dcc Fix lack of cookie check on hard reconnect ... Section 4.2.8 of RFC 6347 describes how to handle the case of a DTLS client establishing a new connection using the same UDP quartet as an already active connection, which we implement under the compile option MBEDTLS_SSL_DLTS_CLIENT_PORT_REUSE. Relevant excerpts: [the server] MUST NOT destroy the existing association until the client has demonstrated reachability either by completing a cookie exchange or by completing a complete handshake including delivering a verifiable Finished message. [...] The reachability requirement prevents off-path/blind attackers from destroying associations merely by sending forged ClientHellos. Our code chooses to use a cookie exchange for establishing reachability, but unfortunately that check was effectively removed in a recent refactoring, which changed what value ssl_handle_possible_reconnect() needs to return in order for ssl_get_next_record() (introduced in that refactoring) to take the proper action. Unfortunately, in addition to changing the value, the refactoring also changed a return statement to an assignment to the ret variable, causing the function to reach the code for a valid cookie, which immediately destroys the existing association, effectively bypassing the cookie verification. This commit fixes that by immediately returning after sending a HelloVerifyRequest when a ClientHello without a valid cookie is found. It also updates the description of the function to reflect the new return value convention (the refactoring updated the code but not the documentation). The commit that changed the return value convention (and introduced the bug) is 2fddd3765e, whose commit message explains the change. Note: this bug also indirectly caused the ssl-opt.sh test case "DTLS client reconnect from same port: reconnect" to occasionally fail due to a race condition between the reception of the ClientHello carrying a valid cookie and the closure of the connection by the server after noticing the ClientHello didn't carry a valid cookie after it incorrectly destroyed the previous connection, that could cause that ClientHello to be invisible to the server (if that message reaches the server just before it does `net_close()`). A welcome side effect of this commit is to remove that race condition, as the new connection will immediately start with a ClientHello carrying a valid cookie in the SSL input buffer, so the server will not call `net_close()` and not risk discarding a better ClientHello that arrived in the meantime. Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>		2020-05-21 10:12:25 -04:00
..
.jenkins	Add Jenkinsfile for PR job	2018-10-19 15:25:10 +01:00
configs	Add a test component with malloc(0) returning NULL	2020-03-13 12:03:12 +00:00
data_files	Merge mbedtls 2.16.6 into baremetal	2020-05-18 11:47:25 -04:00
git-scripts	Add doxygen.sh script to git hooks	2018-06-27 17:41:00 +03:00
scripts	Merge mbedtls 2.16.6 into baremetal	2020-05-18 11:47:25 -04:00
suites	Merge mbedtls 2.16.6 into baremetal	2020-05-18 11:47:25 -04:00
.gitignore
CMakeLists.txt	Add test suite for tinycrypt	2019-09-09 08:19:56 +03:00
compat.sh	compat.sh: Introduce env variable for CRTs, CAs and keys	2019-09-04 16:19:49 +01:00
Descriptions.txt
Makefile	Fix tests to work in Mbed OS test environment	2019-10-24 15:48:47 +03:00
ssl-opt.sh	Fix lack of cookie check on hard reconnect	2020-05-21 10:12:25 -04:00