mirrors/utls
1
0
Fork 0
mirror of https://github.com/refraction-networking/utls.git synced 2025-04-03 03:57:36 +03:00
Code Issues Projects Releases Packages Wiki Activity
Fork of the Go standard TLS library, providing low-level access to the ClientHello for mimicry purposes.
411 commits 7 branches 42 tags 12 MiB
Find a file
Roland Shoemaker ba1a41d66f crypto/tls: replace all usages of BytesOrPanic 
Message marshalling makes use of BytesOrPanic a lot, under the
assumption that it will never panic. This assumption was incorrect, and
specifically crafted handshakes could trigger panics. Rather than just
surgically replacing the usages of BytesOrPanic in paths that could
panic, replace all usages of it with proper error returns in case there
are other ways of triggering panics which we didn't find.

In one specific case, the tree routed by expandLabel, we replace the
usage of BytesOrPanic, but retain a panic. This function already
explicitly panicked elsewhere, and returning an error from it becomes
rather painful because it requires changing a large number of APIs.
The marshalling is unlikely to ever panic, as the inputs are all either
fixed length, or already limited to the sizes required. If it were to
panic, it'd likely only be during development. A close inspection shows
no paths for a user to cause a panic currently.

This patches ends up being rather large, since it requires routing
errors back through functions which previously had no error returns.
Where possible I've tried to use helpers that reduce the verbosity
of frequently repeated stanzas, and to make the diffs as minimal as
possible.

Thanks to Marten Seemann for reporting this issue.

Fixes #58001
Fixes CVE-2022-41724

Change-Id: Ieb55867ef0a3e1e867b33f09421932510cb58851
Reviewed-on: 1679436
Reviewed-by: Julie Qiu <julieqiu@google.com>
TryBot-Result: Security TryBots <security-trybots@go-security-trybots.iam.gserviceaccount.com>
Run-TryBot: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/468125
Run-TryBot: Michael Pratt <mpratt@google.com>
Reviewed-by: Than McIntosh <thanm@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Auto-Submit: Michael Pratt <mpratt@google.com>
2023-02-14 16:52:30 +00:00
fipsonly [dev.boringcrypto] all: add boringcrypto build tags 2022-04-29 14:23:22 +00:00
testdata crypto/ecdsa: use bigmod and nistec instead of math/big and crypto/elliptic 2022-11-21 16:19:34 +00:00
alert.go crypto/tls: add missing alert values 2020-04-01 19:32:57 +00:00
auth.go [dev.boringcrypto] all: merge commit 9d0819b27c (CL 314609) into dev.boringcrypto 2021-05-13 12:59:22 -04:00
auth_test.go [dev.boringcrypto] all: merge master into dev.boringcrypto 2020-04-08 17:48:41 -04:00
boring.go [dev.boringcrypto] crypto/x509: remove VerifyOptions.IsBoring 2022-04-29 14:23:29 +00:00
boring_test.go crypto/tls: replace all usages of BytesOrPanic 2023-02-14 16:52:30 +00:00
cache.go crypto/tls: fix typo in cacheEntry godoc 2023-01-05 19:33:00 +00:00
cache_test.go crypto/tls: add a certificate cache implementation 2022-11-07 19:46:27 +00:00
cipher_suites.go all: fix problematic comments 2022-11-11 19:12:52 +00:00
common.go crypto/tls: replace all usages of BytesOrPanic 2023-02-14 16:52:30 +00:00
common_string.go crypto/tls: add {SignatureScheme,CurveID,ClientAuthType}.String() 2020-03-11 20:02:18 +00:00
conn.go crypto/tls: replace all usages of BytesOrPanic 2023-02-14 16:52:30 +00:00
conn_test.go crypto/tls: select only compatible chains from Certificates 2019-11-12 01:08:57 +00:00
example_test.go crypto/tls: replace VerifyPeerCertificate example with VerifyConnection 2020-06-24 20:48:12 +00:00
generate_cert.go crypto/tls: delete unnecessary line of return 2022-08-08 15:22:02 +00:00
handshake_client.go crypto/tls: replace all usages of BytesOrPanic 2023-02-14 16:52:30 +00:00
handshake_client_test.go crypto/tls: replace all usages of BytesOrPanic 2023-02-14 16:52:30 +00:00
handshake_client_tls13.go crypto/tls: replace all usages of BytesOrPanic 2023-02-14 16:52:30 +00:00
handshake_messages.go crypto/tls: replace all usages of BytesOrPanic 2023-02-14 16:52:30 +00:00
handshake_messages_test.go crypto/tls: replace all usages of BytesOrPanic 2023-02-14 16:52:30 +00:00
handshake_server.go crypto/tls: replace all usages of BytesOrPanic 2023-02-14 16:52:30 +00:00
handshake_server_test.go crypto/tls: replace all usages of BytesOrPanic 2023-02-14 16:52:30 +00:00
handshake_server_tls13.go crypto/tls: replace all usages of BytesOrPanic 2023-02-14 16:52:30 +00:00
handshake_test.go crypto/tls: set default minimum client version to TLS 1.2 2021-11-05 22:03:24 +00:00
handshake_unix_test.go all: use new "unix" build tag where appropriate 2022-03-29 16:24:51 +00:00
key_agreement.go crypto/ecdh: move ECDH method to PrivateKey 2022-11-16 14:37:29 +00:00
key_schedule.go crypto/tls: replace all usages of BytesOrPanic 2023-02-14 16:52:30 +00:00
key_schedule_test.go crypto/tls: implement TLS 1.3 cryptographic computations 2018-11-02 21:54:52 +00:00
link_test.go all: use ":" for compiler generated symbols 2022-08-09 11:28:56 +00:00
notboring.go [dev.boringcrypto] crypto/x509: remove VerifyOptions.IsBoring 2022-04-29 14:23:29 +00:00
prf.go crypto/tls: remove unused hashForClientCertificate param 2022-08-14 00:26:03 +00:00
prf_test.go crypto/tls: remove SSLv3 support 2019-08-27 22:24:05 +00:00
ticket.go crypto/tls: replace all usages of BytesOrPanic 2023-02-14 16:52:30 +00:00
tls.go crypto/tls: add HandshakeContext method to Conn 2021-03-16 14:05:45 +00:00
tls_test.go crypto/tls: make cipher suite preference ordering automatic 2021-05-08 05:15:48 +00:00