{"push_id":802296208,"size":9,"distinct_size":9,"ref":"refs/heads/master","head":"373dc6e196835c06f31ff34cd188471f296126c1","before":"1556d21850aabf31c554d3c6de2363979a965a9f","commits":[{"sha":"01b7851aa27aa144372f5484da916be042d9aa4f","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Add BIO_CTRL_DGRAM_SET_PEEK_MODE\n\nAdd the ability to peek at a message from the DTLS read BIO. This is needed\nfor the DTLSv1_listen rewrite.\n\nReviewed-by: Andy Polyakov <appro@openssl.org>","distinct":true,"url":"https://api.github.com/repos/openssl/openssl/commits/01b7851aa27aa144372f5484da916be042d9aa4f"},{"sha":"e3d0dae7cf8363ca462ac425b72c7bb31c3b4b7a","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"DTLSv1_listen rewrite\n\nThe existing implementation of DTLSv1_listen() is fundamentally flawed. This\nfunction is used in DTLS solutions to listen for new incoming connections\nfrom DTLS clients. A client will send an initial ClientHello. The server\nwill respond with a HelloVerifyRequest containing a unique cookie. The\nclient the responds with a second ClientHello - which this time contains the\ncookie.\n\nOnce the cookie has been verified then DTLSv1_listen() returns to user code,\nwhich is typically expected to continue the handshake with a call to (for\nexample) SSL_accept().\n\nWhilst listening for incoming ClientHellos, the underlying BIO is usually in\nan unconnected state. Therefore ClientHellos can come in from *any* peer.\nThe arrival of the first ClientHello without the cookie, and the second one\nwith it, could be interspersed with other intervening messages from\ndifferent clients.\n\nThe whole purpose of this mechanism is as a defence against DoS attacks. The\nidea is to avoid allocating state on the server until the client has\nverified that it is capable of receiving messages at the address it claims\nto come from. However the existing DTLSv1_listen() implementation completely\nfails to do this. It attempts to super-impose itself on the standard state\nmachine and reuses all of this code. However the standard state machine\nexpects to operate in a stateful manner with a single client, and this can\ncause various problems.\n\nA second more minor issue is that the return codes from this function are\nquite confused, with no distinction made between fatal and non-fatal errors.\nMost user code treats all errors as non-fatal, and simply retries the call\nto DTLSv1_listen().\n\nThis commit completely rewrites the implementation of DTLSv1_listen() and\nprovides a stand alone implementation that does not rely on the existing\nstate machine. It also provides more consistent return codes.\n\nReviewed-by: Andy Polyakov <appro@openssl.org>","distinct":true,"url":"https://api.github.com/repos/openssl/openssl/commits/e3d0dae7cf8363ca462ac425b72c7bb31c3b4b7a"},{"sha":"912c89c529de78de807f58072ae77456b4a251b5","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Remove remaining old listen code\n\nThe old implementation of DTLSv1_listen which has now been replaced still\nhad a few vestiges scattered throughout the code. This commit removes them.\n\nReviewed-by: Andy Polyakov <appro@openssl.org>","distinct":true,"url":"https://api.github.com/repos/openssl/openssl/commits/912c89c529de78de807f58072ae77456b4a251b5"},{"sha":"fd4e98ec8423cbcfc09aef62de2b9b0108c875c6","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Add support for DTLSv1_listen in s_server\n\nDTLSv1_listen is a commonly used function within DTLS solutions for\nlistening for new incoming connections. This commit adds support to s_server\nfor using it.\n\nReviewed-by: Andy Polyakov <appro@openssl.org>","distinct":true,"url":"https://api.github.com/repos/openssl/openssl/commits/fd4e98ec8423cbcfc09aef62de2b9b0108c875c6"},{"sha":"35d15a3952d50f243451c5f9fce1e2d9b88b67bb","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Add -listen documentation\n\nThis commit adds documentation for the new -listen option to s_server. Along\nthe way it also adds documentation for -dtls, -dtls1 and -dtls1_2 which was\nmissing.\n\nReviewed-by: Andy Polyakov <appro@openssl.org>","distinct":true,"url":"https://api.github.com/repos/openssl/openssl/commits/35d15a3952d50f243451c5f9fce1e2d9b88b67bb"},{"sha":"ca7256fbd947870101220735dc375862ec7eb9b1","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Add DTLSv1_listen documentation\n\nAdds a new man page to cover the DTLSv1_listen() function.\n\nReviewed-by: Andy Polyakov <appro@openssl.org>","distinct":true,"url":"https://api.github.com/repos/openssl/openssl/commits/ca7256fbd947870101220735dc375862ec7eb9b1"},{"sha":"d8249e99b9477ca059d5ed016fa49389bc0eb9e9","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Fix s_server DTLSv1_listen issues\n\nUse sockaddr_storage not sockaddr for the client IP address to allow for\nIPv6.\nAlso fixed a section of code which was conditional on OPENSSL_NO_DTLS1\nwhich should not have been.\n\nReviewed-by: Andy Polyakov <appro@openssl.org>","distinct":true,"url":"https://api.github.com/repos/openssl/openssl/commits/d8249e99b9477ca059d5ed016fa49389bc0eb9e9"},{"sha":"468f043ece0e7e262ee6166ae6ec1f7683d82220","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Clarify DTLSv1_listen documentation\n\nClarify that user code is required to allocate sufficient space for the\naddressing scheme in use in the call to DTLSv1_listen.\n\nReviewed-by: Andy Polyakov <appro@openssl.org>","distinct":true,"url":"https://api.github.com/repos/openssl/openssl/commits/468f043ece0e7e262ee6166ae6ec1f7683d82220"},{"sha":"373dc6e196835c06f31ff34cd188471f296126c1","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Sanity check cookie_len\n\nAdd a sanity check that the cookie_len returned by app_gen_cookie_cb is\nvalid.\n\nReviewed-by: Andy Polyakov <appro@openssl.org>","distinct":true,"url":"https://api.github.com/repos/openssl/openssl/commits/373dc6e196835c06f31ff34cd188471f296126c1"}]}