From 16c52db46533b3c32eaef2b80bbff470389dfa5b Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Thu, 10 Mar 2022 15:09:57 +0100 Subject: [PATCH] ssl: first pass limit when allocating buffer for certificates With this check, on the first packet of a certificate presenting a length of 16Mbytes, we only allocate up to 65Kb When we get to the point where need more than 65Kb, we realloc to the true size. With this check, it makes it more expensive for an attacket to use this allocation as a way to trigger ressource exhaustion... (cherry picked from commit 862e84877ff262cd4b8c4b191a8710f94f63fcf7) --- src/app-layer-ssl.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/app-layer-ssl.c b/src/app-layer-ssl.c index dd23d0b46b..573ff8b74e 100644 --- a/src/app-layer-ssl.c +++ b/src/app-layer-ssl.c @@ -1412,6 +1412,12 @@ static uint32_t GetCertsLen(SSLStateConnp *curr_connp, const uint8_t *input, } } +// For certificates whose size is bigger than this, +// we do not allocate all the required memory straight away, +// to avoid DOS by RAM exhaustion, but we will allocate +// this memory once a consequent part of the certificate has been seen. +#define SSL_CERT_MAX_FIRST_ALLOC 65536 // 0x10000 + /** \internal * \brief setup or grow the `trec` space in the connp */ @@ -1425,6 +1431,10 @@ static int EnsureRecordSpace(SSLStateConnp *curr_connp, const uint8_t * const in SCLogDebug("cert_len unknown still, create small buffer to start"); certs_len = 256; } + // Limit in a first time allocation for very large certificates + if (certs_len > SSL_CERT_MAX_FIRST_ALLOC && certs_len > curr_connp->trec_pos + input_len) { + certs_len = SSL_CERT_MAX_FIRST_ALLOC; + } if (curr_connp->trec == NULL) { curr_connp->trec_len = certs_len; -- 2.47.2