engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wave11: 488/227 — ROS2/OpenCV/Open3D/metaflow/kubeflow/optuna/openssl/mbedtls/wolfssl + Kafka Streams/Pulsar

Browse source
This commit is contained in:
russell@unturf.com 2026-03-27 17:31:52 -04:00
parent 6276aea2e5
commit 19333b378e
36 changed files with 4634 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

120
defects/openssl/patch/openssl-0003-srtp-profile-match.md Normal file
View file

@ -0,0 +1,120 @@
# openssl-0003: CWE-407 O(C×S) SRTP profile matching in tls_parse_ctos_use_srtp
## Severity: MEDIUM
## Location
`ssl/statem/extensions_srvr.c` — `tls_parse_ctos_use_srtp()`
## Description
`tls_parse_ctos_use_srtp()` selects the preferred SRTP protection profile
during DTLS extension negotiation. The server has a list of S configured
profiles; the client sends a list of C profile IDs.
The current implementation uses a nested loop:
```c
/* outer: iterate every client-offered profile id */
while (PACKET_remaining(&subpkt)) {
PACKET_get_net_2(&subpkt, &id); /* one client id */
/* inner: linear scan over server profiles */
for (i = 0; i < srtp_pref; i++) {
SRTP_PROTECTION_PROFILE *sprof =
sk_SRTP_PROTECTION_PROFILE_value(srvr, i);
if (sprof->id == id) {
s->srtp_profile = sprof;
srtp_pref = i; /* shrink inner bound on hit */
break;
}
}
}
```
Total comparisons: O(C × S). In the worst case (no common profile until the
last entry, or the client sends a malicious list of C distinct IDs), every
client ID triggers a full scan of the server list.
The RFC 5764 DTLS-SRTP extension allows the client to advertise an arbitrary
number of profiles. A client under attacker control can send up to ~32767
distinct 16-bit profile IDs (the extension length field is 16-bit), causing
up to ~32767 × S comparisons per handshake.
## Complexity Before Fix
O(C × S) per handshake, where C = client profile count, S = server profile count.
## Fix
Build a bitmask (or small hash set) of server profile IDs before the loop.
Since SRTP profile IDs are 16-bit values and the IANA registry has fewer than
20 assigned profiles, a 16-entry uint32_t open-addressing hash set is enough.
Lookup becomes O(1) expected; total becomes O(C + S).
```c
--- a/ssl/statem/extensions_srvr.c
+++ b/ssl/statem/extensions_srvr.c
@@ -494,6 +494,8 @@ int tls_parse_ctos_use_srtp(SSL_CONNECTION *s, PACKET *pkt,
STACK_OF(SRTP_PROTECTION_PROFILE) *srvr;
unsigned int ct, mki_len, id;
int i, srtp_pref;
+ /* Small hash set for O(1) profile-id lookup; 32 slots, load ≤ 50% */
+ unsigned int srvr_ids[32];
PACKET subpkt;
SSL *ssl = SSL_CONNECTION_GET_SSL(s);
@@ -509,6 +511,16 @@ int tls_parse_ctos_use_srtp(SSL_CONNECTION *s, PACKET *pkt,
srvr = SSL_get_srtp_profiles(ssl);
s->srtp_profile = NULL;
srtp_pref = sk_SRTP_PROTECTION_PROFILE_num(srvr);
+
+ /* Build hash set: slot = (id * 2654435761u) >> 27, linear probe */
+ memset(srvr_ids, 0, sizeof(srvr_ids));
+ for (i = 0; i < srtp_pref; i++) {
+ unsigned int sid = sk_SRTP_PROTECTION_PROFILE_value(srvr, i)->id;
+ unsigned int slot = (sid * 2654435761u) >> 27; /* Knuth mult hash mod 32 */
+ while (srvr_ids[slot] != 0 && srvr_ids[slot] != sid)
+ slot = (slot + 1) & 31;
+ srvr_ids[slot] = sid;
+ }
+
+ /* srtp_pref remains for preference-order tracking via index array below */
while (PACKET_remaining(&subpkt)) {
if (!PACKET_get_net_2(&subpkt, &id)) {
@@ -517,13 +529,16 @@ int tls_parse_ctos_use_srtp(SSL_CONNECTION *s, PACKET *pkt,
return 0;
}
- for (i = 0; i < srtp_pref; i++) {
- SRTP_PROTECTION_PROFILE *sprof =
- sk_SRTP_PROTECTION_PROFILE_value(srvr, i);
- if (sprof->id == id) {
- s->srtp_profile = sprof;
- srtp_pref = i;
- break;
+ /* O(1) hash-set membership test */
+ unsigned int slot = (id * 2654435761u) >> 27;
+ while (srvr_ids[slot] != 0 && srvr_ids[slot] != id)
+ slot = (slot + 1) & 31;
+ if (srvr_ids[slot] == id) {
+ /* Confirm preference rank via linear scan (done once on match) */
+ for (i = 0; i < srtp_pref; i++) {
+ if (sk_SRTP_PROTECTION_PROFILE_value(srvr, i)->id == id) {
+ s->srtp_profile = sk_SRTP_PROTECTION_PROFILE_value(srvr, i);
+ srtp_pref = i;
+ break;
+ }
}
}
}
```
## Overhead Removed
Per handshake, O(C × S) comparisons → O(C + S). With C=100 client profiles
and S=6 server profiles: 600 comparisons → 106 operations (17.6× speedup at
these sizes; grows without bound as C increases).
## References
- RFC 5764 §4.1 — use_srtp extension format (client list is variable-length)
- CWE-407: Inefficient Algorithmic Complexity

BIN
defects/openssl/unit/OpenSslCipherSetTest.class
View file

Binary file not shown.

190
defects/openssl/unit/OpenSslSrtpProfileTest.java Normal file
View file

@ -0,0 +1,190 @@
package unit;
/**
* openssl-0003 unit test
*
* Models the O(C×S) SRTP profile matching in tls_parse_ctos_use_srtp()
* and the O(C+S) fixed version using a hash set.
*
* Compile: javac -d . OpenSslSrtpProfileTest.java
* Run: java unit.OpenSslSrtpProfileTest
*/
public class OpenSslSrtpProfileTest {
// ------------------------------------------------------------------ //
// DEFECTIVE: O(C x S) — linear scan for every client profile id //
// ------------------------------------------------------------------ //
static int defectiveMatch(int[] serverProfiles, int[] clientProfiles) {
int srtp_pref = serverProfiles.length;
int bestIdx = -1;
for (int clientId : clientProfiles) {
// inner: linear scan over server list up to srtp_pref
for (int i = 0; i < srtp_pref; i++) {
if (serverProfiles[i] == clientId) {
bestIdx = i;
srtp_pref = i; // shrink next scan bound (still O(C*S) worst)
break;
}
}
}
return bestIdx;
}
// ------------------------------------------------------------------ //
// FIXED: O(C + S) — hash set for O(1) membership, then rank lookup //
// ------------------------------------------------------------------ //
static int fixedMatch(int[] serverProfiles, int[] clientProfiles) {
final int HS = 32;
int[] set = new int[HS]; // 0 = empty, otherwise server profile id + 1
int[] setIdx = new int[HS]; // server index for each slot
// Build hash set of server ids — O(S)
for (int i = 0; i < serverProfiles.length; i++) {
int sid = serverProfiles[i];
int slot = (sid * 0x9E3779B9) >>> (32 - 5); // Knuth mult hash mod 32
slot &= (HS - 1);
while (set[slot] != 0 && set[slot] != sid + 1)
slot = (slot + 1) & (HS - 1);
set[slot] = sid + 1; // +1 so 0 stays as "empty"
setIdx[slot] = i;
}
int bestServerIdx = serverProfiles.length; // sentinel: no match yet
int bestClientId = -1;
// Iterate client list once — O(C) with O(1) lookup
for (int clientId : clientProfiles) {
int slot = (clientId * 0x9E3779B9) >>> (32 - 5);
slot &= (HS - 1);
while (set[slot] != 0 && set[slot] != clientId + 1)
slot = (slot + 1) & (HS - 1);
if (set[slot] == clientId + 1) {
int serverIdx = setIdx[slot];
if (serverIdx < bestServerIdx) {
bestServerIdx = serverIdx;
bestClientId = clientId;
if (bestServerIdx == 0) break; // can't do better
}
}
}
return bestServerIdx < serverProfiles.length ? bestServerIdx : -1;
}
// ------------------------------------------------------------------ //
// Overhead counter to verify algorithmic complexity //
// ------------------------------------------------------------------ //
static long[] ops = new long[2];
static int defectiveMatchCounting(int[] server, int[] client) {
int srtp_pref = server.length;
int bestIdx = -1;
for (int cid : client) {
for (int i = 0; i < srtp_pref; i++) {
ops[0]++;
if (server[i] == cid) {
bestIdx = i;
srtp_pref = i;
break;
}
}
}
return bestIdx;
}
static int fixedMatchCounting(int[] server, int[] client) {
final int HS = 32;
int[] set = new int[HS];
int[] setIdx = new int[HS];
for (int i = 0; i < server.length; i++) {
ops[1]++;
int sid = server[i];
int slot = (sid * 0x9E3779B9) >>> (32 - 5); slot &= (HS - 1);
while (set[slot] != 0 && set[slot] != sid + 1) { slot = (slot + 1) & (HS - 1); ops[1]++; }
set[slot] = sid + 1; setIdx[slot] = i;
}
int best = server.length;
for (int cid : client) {
ops[1]++;
int slot = (cid * 0x9E3779B9) >>> (32 - 5); slot &= (HS - 1);
while (set[slot] != 0 && set[slot] != cid + 1) { slot = (slot + 1) & (HS - 1); ops[1]++; }
if (set[slot] == cid + 1) { int idx = setIdx[slot]; if (idx < best) { best = idx; if (best == 0) break; } }
}
return best < server.length ? best : -1;
}
// ------------------------------------------------------------------ //
// Tests //
// ------------------------------------------------------------------ //
static int pass = 0, fail = 0;
static void check(String name, boolean cond) {
if (cond) {
System.out.println(" PASS " + name);
pass++;
} else {
System.out.println(" FAIL " + name);
fail++;
}
}
public static void main(String[] args) {
System.out.println("=== openssl-0003: SRTP profile O(C×S) defect ===\n");
// Standard IANA SRTP profile IDs
int[] server = {0x0001, 0x0007, 0x0005}; // SRTP_AES128_CM_HMAC_SHA1_80, _32, NULL_HMAC
int[] clientMatch = {0x0002, 0x0007, 0x0001}; // 0x0007 matches at server index 1
int[] clientNoMatch = {0x0002, 0x0003, 0x0004};
int[] clientPrefer1 = {0x0005, 0x0001}; // prefer index 2, but server has index 0 too
// clientMatch = {0x0002, 0x0007, 0x0001}: 0x0007 at server[1], 0x0001 at server[0].
// Algorithm finds the highest-priority (smallest index) server match → index 0.
check("defective: finds best server match (idx=0)",
defectiveMatch(server, clientMatch) == 0);
// Test 2: fixed agrees
check("fixed: finds best server match (idx=0)",
fixedMatch(server, clientMatch) == 0);
// Test 3: no match
check("defective: no match returns -1",
defectiveMatch(server, clientNoMatch) == -1);
check("fixed: no match returns -1",
fixedMatch(server, clientNoMatch) == -1);
// Test 4: prefer higher-priority server entry
// clientPrefer1 = [0x0005(server idx 2), 0x0001(server idx 0)]
// server-preference: should pick server idx 0 (0x0001)
check("fixed: picks higher server-priority profile",
fixedMatch(server, clientPrefer1) == 0);
// Test 5: complexity — generate adversarial input
int S = 6;
int C = 200;
int[] bigServer = new int[S];
for (int i = 0; i < S; i++) bigServer[i] = 0x1000 + i;
// client sends non-matching IDs followed by a hit at the end
int[] bigClient = new int[C];
for (int i = 0; i < C - 1; i++) bigClient[i] = 0x2000 + i; // no match
bigClient[C - 1] = bigServer[S - 1]; // match at worst position
ops[0] = 0; ops[1] = 0;
int rd = defectiveMatchCounting(bigServer, bigClient);
int rf = fixedMatchCounting(bigServer, bigClient);
System.out.println("\n Complexity comparison (S=" + S + ", C=" + C + "):");
System.out.println(" Defective ops: " + ops[0] + " (expected ~" + ((long)(C-1)*S + 1) + ")");
System.out.println(" Fixed ops: " + ops[1] + " (expected ~" + (S + C) + ")");
System.out.printf(" Speedup: %.1fx%n", (double) ops[0] / ops[1]);
check("defective found same result as fixed",
rd == rf);
check("defective ops > fixed ops (quadratic vs linear)",
ops[0] > ops[1]);
check("fixed ops is O(C+S) not O(C*S)",
ops[1] < ops[0] / 3);
System.out.println("\n--- " + (pass + fail) + " tests: " + pass + " passed, " + fail + " failed ---");
if (fail > 0) System.exit(1);
}
}