diff options
author | FdaSilvaYY <fdasilvayy@gmail.com> | 2017-04-07 19:15:38 +0200 |
---|---|---|
committer | Richard Levitte <levitte@openssl.org> | 2017-04-28 15:49:36 +0200 |
commit | 36b2cfb191f4a3f3a49b7c4d865308b7021daa42 (patch) | |
tree | 6cd0284a5b013cf94d134c9a30f671b8e7751cf5 /apps | |
parent | 67887855af3bfbf3f44b246aa83db6faeddae886 (diff) | |
download | openssl-36b2cfb191f4a3f3a49b7c4d865308b7021daa42.tar.gz |
Add checks on return code when applying some settings.
Remove hardcoded bound checkings.
Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3141)
Diffstat (limited to 'apps')
-rw-r--r-- | apps/s_client.c | 59 | ||||
-rw-r--r-- | apps/s_server.c | 56 |
2 files changed, 40 insertions, 75 deletions
diff --git a/apps/s_client.c b/apps/s_client.c index c86d36c5b6..6cb2e73c61 100644 --- a/apps/s_client.c +++ b/apps/s_client.c @@ -665,11 +665,11 @@ const OPTIONS s_client_options[] = { {"async", OPT_ASYNC, '-', "Support asynchronous operation"}, {"ssl_config", OPT_SSL_CONFIG, 's', "Use specified configuration file"}, {"max_send_frag", OPT_MAX_SEND_FRAG, 'p', "Maximum Size of send frames "}, - {"split_send_frag", OPT_SPLIT_SEND_FRAG, 'n', + {"split_send_frag", OPT_SPLIT_SEND_FRAG, 'p', "Size used to split data for encrypt pipelines"}, - {"max_pipelines", OPT_MAX_PIPELINES, 'n', + {"max_pipelines", OPT_MAX_PIPELINES, 'p', "Maximum number of encrypt/decrypt pipelines to be used"}, - {"read_buf", OPT_READ_BUF, 'n', + {"read_buf", OPT_READ_BUF, 'p', "Default read buffer size to be used for connections"}, OPT_S_OPTIONS, OPT_V_OPTIONS, @@ -896,7 +896,7 @@ int s_client_main(int argc, char **argv) int min_version = 0, max_version = 0, prot_opt = 0, no_prot_opt = 0; int async = 0; unsigned int max_send_fragment = 0; - unsigned int split_send_fragment = 0, max_pipelines = 0; + unsigned int split_send_fragment = 0, max_pipelines = 0; enum { use_inet, use_unix, use_unknown } connect_type = use_unknown; int count4or6 = 0; int c_nbio = 0, c_msg = 0, c_ign_eof = 0, c_brief = 0; @@ -1381,23 +1381,9 @@ int s_client_main(int argc, char **argv) break; case OPT_MAX_SEND_FRAG: max_send_fragment = atoi(opt_arg()); - if (max_send_fragment == 0) { - /* - * Not allowed - set to a deliberately bad value so we get an - * error message below - */ - max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH + 1; - } break; case OPT_SPLIT_SEND_FRAG: split_send_fragment = atoi(opt_arg()); - if (split_send_fragment == 0) { - /* - * Not allowed - set to a deliberately bad value so we get an - * error message below - */ - split_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH + 1; - } break; case OPT_MAX_PIPELINES: max_pipelines = atoi(opt_arg()); @@ -1486,20 +1472,6 @@ int s_client_main(int argc, char **argv) socket_type = SOCK_STREAM; } #endif - if (max_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) { - BIO_printf(bio_err, "%s: Bad max send fragment size\n", prog); - goto end; - } - - if (split_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) { - BIO_printf(bio_err, "%s: Bad split send fragment size\n", prog); - goto end; - } - - if (max_pipelines > SSL_MAX_PIPELINES) { - BIO_printf(bio_err, "%s: Bad max pipelines value\n", prog); - goto end; - } #if !defined(OPENSSL_NO_NEXTPROTONEG) next_proto.status = -1; @@ -1623,14 +1595,25 @@ int s_client_main(int argc, char **argv) SSL_CTX_set_mode(ctx, SSL_MODE_ASYNC); } - if (max_send_fragment > 0) - SSL_CTX_set_max_send_fragment(ctx, max_send_fragment); + if (max_send_fragment > 0 + && !SSL_CTX_set_max_send_fragment(ctx, max_send_fragment)) { + BIO_printf(bio_err, "%s: Max send fragment size %u is out of permitted range\n", + prog, max_send_fragment); + goto end; + } - if (split_send_fragment > 0) { - SSL_CTX_set_split_send_fragment(ctx, split_send_fragment); + if (split_send_fragment > 0 + && !SSL_CTX_set_split_send_fragment(ctx, split_send_fragment)) { + BIO_printf(bio_err, "%s: Split send fragment size %u is out of permitted range\n", + prog, split_send_fragment); + goto end; } - if (max_pipelines > 0) { - SSL_CTX_set_max_pipelines(ctx, max_pipelines); + + if (max_pipelines > 0 + && !SSL_CTX_set_max_pipelines(ctx, max_pipelines)) { + BIO_printf(bio_err, "%s: Max pipelines %u is out of permitted range\n", + prog, max_pipelines); + goto end; } if (read_buf_len > 0) { diff --git a/apps/s_server.c b/apps/s_server.c index 22131bf84f..e597ecbeb1 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -858,11 +858,11 @@ const OPTIONS s_server_options[] = { {"ssl_config", OPT_SSL_CONFIG, 's', "Configure SSL_CTX using the configuration 'val'"}, {"max_send_frag", OPT_MAX_SEND_FRAG, 'p', "Maximum Size of send frames "}, - {"split_send_frag", OPT_SPLIT_SEND_FRAG, 'n', + {"split_send_frag", OPT_SPLIT_SEND_FRAG, 'p', "Size used to split data for encrypt pipelines"}, - {"max_pipelines", OPT_MAX_PIPELINES, 'n', + {"max_pipelines", OPT_MAX_PIPELINES, 'p', "Maximum number of encrypt/decrypt pipelines to be used"}, - {"read_buf", OPT_READ_BUF, 'n', + {"read_buf", OPT_READ_BUF, 'p', "Default read buffer size to be used for connections"}, OPT_S_OPTIONS, OPT_V_OPTIONS, @@ -1502,23 +1502,9 @@ int s_server_main(int argc, char *argv[]) break; case OPT_MAX_SEND_FRAG: max_send_fragment = atoi(opt_arg()); - if (max_send_fragment == 0) { - /* - * Not allowed - set to a deliberately bad value so we get an - * error message below - */ - max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH + 1; - } break; case OPT_SPLIT_SEND_FRAG: split_send_fragment = atoi(opt_arg()); - if (split_send_fragment == 0) { - /* - * Not allowed - set to a deliberately bad value so we get an - * error message below - */ - split_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH + 1; - } break; case OPT_MAX_PIPELINES: max_pipelines = atoi(opt_arg()); @@ -1574,20 +1560,6 @@ int s_server_main(int argc, char *argv[]) socket_type = SOCK_STREAM; } #endif - if (max_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) { - BIO_printf(bio_err, "%s: Bad max send fragment size\n", prog); - goto end; - } - - if (split_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) { - BIO_printf(bio_err, "%s:Bad split send fragment size\n", prog); - goto end; - } - - if (max_pipelines > SSL_MAX_PIPELINES) { - BIO_printf(bio_err, "%s:too large max-pipelines value\n", prog); - goto end; - } if (!app_passwd(passarg, dpassarg, &pass, &dpass)) { BIO_printf(bio_err, "Error getting password\n"); @@ -1778,14 +1750,24 @@ int s_server_main(int argc, char *argv[]) SSL_CTX_set_mode(ctx, SSL_MODE_ASYNC); } - if (max_send_fragment > 0) - SSL_CTX_set_max_send_fragment(ctx, max_send_fragment); + if (max_send_fragment > 0 + && !SSL_CTX_set_max_send_fragment(ctx, max_send_fragment)) { + BIO_printf(bio_err, "%s: Max send fragment size %u is out of permitted range\n", + prog, max_send_fragment); + goto end; + } - if (split_send_fragment > 0) { - SSL_CTX_set_split_send_fragment(ctx, split_send_fragment); + if (split_send_fragment > 0 + && !SSL_CTX_set_split_send_fragment(ctx, split_send_fragment)) { + BIO_printf(bio_err, "%s: Split send fragment size %u is out of permitted range\n", + prog, split_send_fragment); + goto end; } - if (max_pipelines > 0) { - SSL_CTX_set_max_pipelines(ctx, max_pipelines); + if (max_pipelines > 0 + && !SSL_CTX_set_max_pipelines(ctx, max_pipelines)) { + BIO_printf(bio_err, "%s: Max pipelines %u is out of permitted range\n", + prog, max_pipelines); + goto end; } if (read_buf_len > 0) { |