Verify TLS MAC even if padding is invalid to prevent timing attacks

diff --git a/src/libtls/tls_protection.c b/src/libtls/tls_protection.c
index e85ded016d8506600035299db084fddeb335ee77..dcc983b9c20bd5a3210231e4bee537e1bee18841 100644 (file)
--- a/src/libtls/tls_protection.c
+++ b/src/libtls/tls_protection.c
@@ -154,13 +154,11 @@ METHOD(tls_protection_t, process, status_t,
                }
 
                padding_length = data.ptr[data.len - 1];
-               if (padding_length >= data.len)
-               {
-                       DBG1(DBG_TLS, "invalid TLS record padding");
-                       this->alert->add(this->alert, TLS_FATAL, TLS_BAD_RECORD_MAC);
-                       return NEED_MORE;
+               if (padding_length < data.len)
+               {       /* remove padding if it looks valid. Continue with no padding, try
+                        * to prevent timing attacks. */
+                       data.len -= padding_length + 1;
                }
-               data.len -= padding_length + 1;
        }
        if (this->signer_in)
        {