Merge pull request #1 from boyvinall/master

fix Deserialise infinite loop for invalid record

Author: boyvinall

.editorconfig

@@ -0,0 +1,8 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 4
+
+[Makefile]
+indent_style = tab

.gitignore

@@ -6,6 +6,7 @@
 *.user
 *.userosscache
 *.sln.docstates
+.vscode
 
 # User-specific files (MonoDevelop/Xamarin Studio)
 *.userprefs
@@ -242,4 +243,4 @@ ModelManifest.xml
 .paket/paket.exe
 
 # FAKE - F# Make
-.fake/
+.fake/

Makefile

@@ -0,0 +1,11 @@
+DTLS_VERSION:=1.0.21
+
+.PHONY: all
+all: src/DTLS.Net/bin/Release/DTLS.Net.$(DTLS_VERSION).nupkg
+
+src/DTLS.Net/bin/Release/DTLS.Net.$(DTLS_VERSION).nupkg:
+	docker run -v $(PWD):/app --entrypoint /app/pack.sh creatordev/dotnet-mono-base Release src/DTLS.Net
+
+.PHONY: clean
+clean:
+	rm -rf src/DTLS.Net/bin src/DTLS.Net/obj src/DTLS.Net/project.lock.json

README.md

@@ -4,9 +4,9 @@
 
 ## DTLS.Net
 
-[![License (3-Clause BSD)](https://img.shields.io/badge/license-BSD%203--Clause-blue.svg?style=flat-square)](http://opensource.org/licenses/BSD-3-Clause)  
+[![License (3-Clause BSD)](https://img.shields.io/badge/license-BSD%203--Clause-blue.svg?style=flat-square)](http://opensource.org/licenses/BSD-3-Clause)
 
-DTLS.Net was developed for use in an [implementation](https://github.com/Creatordev/DeviceServer) of the Open Mobile Alliance's (OMA) Lightweight Machine to Machine protocol (LWM2M). For this reason it only supports the following cipher suites:  
+DTLS.Net was developed for use in an [implementation](https://github.com/Creatordev/DeviceServer) of the Open Mobile Alliance's (OMA) Lightweight Machine to Machine protocol (LWM2M). For this reason it only supports the following cipher suites:
 
 * TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8
 * TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
@@ -16,38 +16,38 @@ DTLS.Net was developed for use in an [implementation](https://github.com/Creator
 
 ### Limitations
 
-Since the client is only required to serve for the above project it has several inherent limitations:  
+Since the client is only required to serve for the above project it has several inherent limitations:
 
-1. No automatic retransmition  
-2. No support for fragmentation of handshake packets  
-3. Does not verify Server Certificates (against CA)  
+1. No automatic retransmission
+2. No support for fragmentation of handshake packets
+3. Does not verify Server Certificates (against CA)
 
-The server currently also has the following limitations:  
+The server currently also has the following limitations:
 
-1. Does not verify client Certificates  
-2. No support for fragmentation of handshake packets  
+1. Does not verify client Certificates
+2. No support for fragmentation of handshake packets
 
 Hopefully over time these will be implemented, in the meantime we hope this is still useful.
 
 ----
 
 ### Contributing
 
-We welcome all contributions to this project and we give credit where it's due. Anything from enhancing functionality to improving documentation and bug reporting - it's all good.  
+We welcome all contributions to this project and we give credit where it's due. Anything from enhancing functionality to improving documentation and bug reporting - it's all good.
 
-Find out more in the [contributor guide](CONTRIBUTING.md).  
+Find out more in the [contributor guide](CONTRIBUTING.md).
 
 ### Credits
-  
-We would like to thank all of our current [contributors](CONTRIBUTORS). 
+
+We would like to thank all of our current [contributors](CONTRIBUTORS).
 
 
 ----
 
 ### License information
 
-* All code and documentation developed by Imagination Technologies Limited is licensed under the [BSD 3-clause license](LICENSE).  
-* Bouncy Castle by The Legion of the Bouncy Castle is licensed under an [adaptation of the MIT X11 License](https://bouncycastle.org/csharp/licence.html).  
+* All code and documentation developed by Imagination Technologies Limited is licensed under the [BSD 3-clause license](LICENSE).
+* Bouncy Castle by The Legion of the Bouncy Castle is licensed under an [adaptation of the MIT X11 License](https://bouncycastle.org/csharp/licence.html).
 
 
 ----

pack.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+CONFIGURATION=$1
+shift
+
+for PACKAGE in $*; do
+    cd /app/$PACKAGE
+    dotnet restore
+    dotnet pack --configuration=$CONFIGURATION
+done

src/DTLS.Net/Client.cs

@@ -12,11 +12,11 @@ 3. Neither the name of the copyright holder nor the names of its contributors ma
         products derived from this software without specific prior written permission.
 
  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
- INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
- DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 
+ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 
- WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE 
+ SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 ***********************************************************************************************************************/
 
@@ -42,7 +42,7 @@ public class Client
         private static Version SupportedVersion = DTLSRecord.Version1_2;
 
         private EndPoint _LocalEndPoint;
-        private int _MaxPacketSize = 1440; 
+        private int _MaxPacketSize = 1440;
         private Socket _Socket;
         private List<TCipherSuite> _SupportedCipherSuites;
 
@@ -130,7 +130,7 @@ private void ProcessHandshake(DTLSRecord record)
             {
 
                 int count = 0;
-                while ((_Cipher == null) && (count < 50))
+                while ((_Cipher == null) && (count < 500))
                 {
                     System.Threading.Thread.Sleep(10);
                     count++;
@@ -616,7 +616,7 @@ private void SendHello(byte[] cookie)
 
             clientHello.Extensions.Add(new Extension() {  ExtensionType = TExtensionType.EncryptThenMAC});
             clientHello.Extensions.Add(new Extension() { ExtensionType = TExtensionType.ExtendedMasterSecret });
-            
+
             EllipticCurvesExtension ellipticCurvesExtension = new EllipticCurvesExtension();
             for (int curve = 0; curve < (int)TEllipticCurve.secp521r1; curve++)
             {
@@ -769,7 +769,7 @@ private void StartReceive(Socket socket)
             socket.ReceiveFromAsync(parameters);
         }
 
-        public void SetVersion(Version version) 
+        public void SetVersion(Version version)
         {
             _Version = version;
         }

src/DTLS.Net/Records/DTLSRecord.cs

@@ -4,19 +4,19 @@ All rights reserved.
 
  Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
  following conditions are met:
-     1. Redistributions of source code must retain the above copyright notice, this list of conditions and the
-        following disclaimer.
-     2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the
-        following disclaimer in the documentation and/or other materials provided with the distribution.
-     3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote
-        products derived from this software without specific prior written permission.
+	 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the
+		following disclaimer.
+	 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the
+		following disclaimer in the documentation and/or other materials provided with the distribution.
+	 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote
+		products derived from this software without specific prior written permission.
 
  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
- INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
- DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 
+ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 
- WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE 
+ SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 ***********************************************************************************************************************/
 
@@ -36,8 +36,8 @@ namespace DTLS
 	internal class DTLSRecord
 	{
 		public static Version DefaultVersion = new Version(1, 0);
-        public static Version Version1_0 = new Version(1, 0);
-        public static Version Version1_2 = new Version(1, 2);
+		public static Version Version1_0 = new Version(1, 0);
+		public static Version Version1_2 = new Version(1, 2);
 
 		public const int RECORD_OVERHEAD = 13;
 
@@ -58,7 +58,7 @@ internal class DTLSRecord
 		 //  opaque fragment[DTLSPlaintext.length];
 		 //} DTLSPlaintext;
 
-		public TRecordType RecordType 
+		public TRecordType RecordType
 		{
 			get { return _RecordType; }
 			set { _RecordType = value; }
@@ -85,7 +85,7 @@ public long SequenceNumber
 		public byte[] Fragment
 		{
 			get { return _Fragment; }
-			set 
+			set
 			{
 				_Fragment = value;
 				if (_Fragment != null)
@@ -108,6 +108,7 @@ public static DTLSRecord Deserialise(Stream stream)
 		{
 			DTLSRecord result = new DTLSRecord();
 			result._RecordType = (TRecordType)stream.ReadByte();
+			// could check here for a valid type, and bail out if invalid
 			result._Version = new Version(255 - stream.ReadByte(), 255 - stream.ReadByte());
 			result._Epoch = NetworkByteOrderConverter.ToUInt16(stream);
 			result._SequenceNumber = NetworkByteOrderConverter.ToInt48(stream);
@@ -116,10 +117,18 @@ public static DTLSRecord Deserialise(Stream stream)
 			{
 				result._Fragment = new byte[result._Length];
 				int length = stream.Read(result._Fragment, 0, result._Length);
-                while (length < result._Length)
-                {
-                    length += stream.Read(result._Fragment, length, result._Length - length);
-                }
+				while (length < result._Length)
+				{
+					int bytesRead = stream.Read(result._Fragment, length, result._Length - length);
+					if (bytesRead > 0)
+					{
+						length += bytesRead;
+					}
+					else
+					{
+						break;
+					}
+				}
 			}
 			return result;
 		}

src/DTLS.Net/project.json

@@ -1,7 +1,7 @@
 {
-  "version": "1.0.19-*",
+  "version": "1.0.21-*",
   "title": "DTLS.Net",
-  "description": "DTLS.Net Class Library", 
+  "description": "DTLS.Net Class Library",
   "authors": [ "Delme Thomas" ],
   "packOptions": {
     "owners": [ "Imagination Technologies Limited" ],