From: Jo-Philipp Wich <jow@openwrt.org>
Date: Tue, 9 Oct 2012 16:41:36 +0000 (+0000)
Subject: cyassl: add a patch to better check legacy SSLv2 client hello records
X-Git-Tag: reboot~12695
X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=6945d722e682c0a1e5986f8844ad4428c7f97aea;p=openwrt%2Fstaging%2Fchunkeey.git

cyassl: add a patch to better check legacy SSLv2 client hello records

If junk data is received during SSL_accept(), cyassl will treat it as legacy SSLv2
record without performing further plausibility checks. Change the legacy code path
to return UNKNOWN_HANDSHAKE_TYPE if the value of the third byte isn't 0x01 the
hello message type.

SVN-Revision: 33675
---

diff --git a/package/libs/cyassl/Makefile b/package/libs/cyassl/Makefile
index 442186aac7..063e572166 100644
--- a/package/libs/cyassl/Makefile
+++ b/package/libs/cyassl/Makefile
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2006-2010 OpenWrt.org
+# Copyright (C) 2006-2012 OpenWrt.org
 #
 # This is free software, licensed under the GNU General Public License v2.
 # See /LICENSE for more information.
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=cyassl
 PKG_VERSION:=1.6.5
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).zip
 PKG_SOURCE_URL:=http://www.yassl.com/
diff --git a/package/libs/cyassl/patches/200-SSL_accept-handle-hello-garbage.patch b/package/libs/cyassl/patches/200-SSL_accept-handle-hello-garbage.patch
new file mode 100644
index 0000000000..4a6b8da67e
--- /dev/null
+++ b/package/libs/cyassl/patches/200-SSL_accept-handle-hello-garbage.patch
@@ -0,0 +1,13 @@
+--- a/src/cyassl_int.c
++++ b/src/cyassl_int.c
+@@ -1588,6 +1588,10 @@
+                 b1 =
+                 ssl->buffers.inputBuffer.buffer[ssl->buffers.inputBuffer.idx++];
+                 ssl->curSize = ((b0 & 0x7f) << 8) | b1;
++
++                /* does not appear to a be a SSLv2 client hello */
++                if ( ssl->buffers.inputBuffer.buffer[ssl->buffers.inputBuffer.idx] != 1 )
++                    return UNKNOWN_HANDSHAKE_TYPE;
+             }
+             else {
+                 ssl->options.processReply = getRecordLayerHeader;