From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Fri, 8 Mar 2002 22:42:16 +0000 (+0000)
Subject: Added protection against denial of service attacks, while receiving
X-Git-Tag: gnutls_0_3_92~43
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4bf19145232da7c0a287bfb37207c13c260ce931;p=thirdparty%2Fgnutls.git

Added protection against denial of service attacks, while receiving
empty packets.
---

diff --git a/lib/gnutls_errors.c b/lib/gnutls_errors.c
index 0c198091d3..526114c2a8 100644
--- a/lib/gnutls_errors.c
+++ b/lib/gnutls_errors.c
@@ -112,6 +112,7 @@ static gnutls_error_entry error_algorithms[] = {
 	GNUTLS_ERROR_ENTRY( GNUTLS_E_ASN1_TYPE_ANY_ERROR, 1),
 	GNUTLS_ERROR_ENTRY( GNUTLS_E_ASN1_SYNTAX_ERROR, 1),
 	GNUTLS_ERROR_ENTRY( GNUTLS_E_ASN1_DER_OVERFLOW, 1),
+	GNUTLS_ERROR_ENTRY( GNUTLS_E_TOO_MANY_EMPTY_PACKETS, 1),
 	{0}
 };
 
diff --git a/lib/gnutls_errors_int.h b/lib/gnutls_errors_int.h
index 0c8493e341..0654737989 100644
--- a/lib/gnutls_errors_int.h
+++ b/lib/gnutls_errors_int.h
@@ -75,6 +75,7 @@
 #define GNUTLS_E_ASN1_TYPE_ANY_ERROR -75
 #define GNUTLS_E_ASN1_SYNTAX_ERROR -76
 #define GNUTLS_E_ASN1_DER_OVERFLOW -77
+#define GNUTLS_E_TOO_MANY_EMPTY_PACKETS -78
 
 #define GNUTLS_E_UNIMPLEMENTED_FEATURE -250
 
diff --git a/lib/gnutls_record.c b/lib/gnutls_record.c
index 6c23e0faf9..7d1fe00a30 100644
--- a/lib/gnutls_record.c
+++ b/lib/gnutls_record.c
@@ -722,6 +722,8 @@ static int _gnutls_record_check_type( GNUTLS_STATE state, ContentType recv_type,
 
 }
 
+#define MAX_EMPTY_PACKETS_SEQUENCE 4
+
 /* This function behave exactly like read(). The only difference is 
  * that it accepts, the gnutls_state and the ContentType of data to
  * send (if called by the user the Content is Userdata only)
@@ -739,8 +741,15 @@ ssize_t gnutls_recv_int( GNUTLS_STATE state, ContentType type, HandshakeType hty
 	uint8 *recv_data;
 	int ret, ret2;
 	uint16 header_size;
+	int empty_packet = 0;
 
 	begin:
+	
+	if (empty_packet > MAX_EMPTY_PACKETS_SEQUENCE) {
+		gnutls_assert();
+		return GNUTLS_E_TOO_MANY_EMPTY_PACKETS;
+	}
+	
 	/* default headers for TLS 1.0
 	 */
 	header_size = RECORD_HEADER_SIZE;
@@ -905,8 +914,11 @@ ssize_t gnutls_recv_int( GNUTLS_STATE state, ContentType type, HandshakeType hty
 
 	/* TLS 1.0 CBC protection. Read the next fragment.
 	 */
-	if (ret==0) goto begin;
-
+	if (ret==0) {
+		empty_packet++;
+		goto begin;
+	}
+	
 	return ret;
 }