From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Mon, 10 Jun 2013 17:09:59 +0000 (+0200)
Subject: DTLS replay protection can now be disabled.
X-Git-Tag: gnutls_3_2_2~63
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9eb2936c8abcd9c9af807931e5d88231b53ab709;p=thirdparty%2Fgnutls.git

DTLS replay protection can now be disabled.
---

diff --git a/NEWS b/NEWS
index e372571dc2..c08b6bba07 100644
--- a/NEWS
+++ b/NEWS
@@ -7,9 +7,12 @@ See the end for copying conditions.
 ** libgnutls: Several optimizations in the related to packet processing
 subsystems.
 
+** libgnutls: DTLS replay protection can now be disabled.
+
 ** API and ABI modifications:
 gnutls_certificate_set_trust_list: Added
 gnutls_cipher_get_tag_size: Added
+gnutls_record_disable_replay_protection: Added
 
 
 * Version 3.2.1 (released 2013-06-01)
diff --git a/lib/gnutls_dtls.c b/lib/gnutls_dtls.c
index 2f3bcdc738..bf76521a69 100644
--- a/lib/gnutls_dtls.c
+++ b/lib/gnutls_dtls.c
@@ -1014,3 +1014,17 @@ unsigned int gnutls_record_get_discarded (gnutls_session_t session)
   return session->internals.dtls.packets_dropped;
 }
 
+/**
+ * gnutls_record_disable_replay_protection:
+ * @session: is a #gnutls_session_t structure.
+ *
+ * This function will disable any replay protection in DTLS mode.
+ * That must only used when replay protection is achieved using
+ * other means.
+ *
+ **/
+void
+gnutls_record_disable_replay_protection (gnutls_session_t session)
+{
+  session->internals.no_replay_protection = 1;
+}
diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index c128c67306..8c6766c8f2 100644
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -997,6 +997,7 @@ typedef struct
   recv_state_t recv_state; /* state of the receive function */
   
   unsigned int sc_random_set:1;
+  unsigned int no_replay_protection:1; /* DTLS replay protection */
   
   /* If you add anything here, check _gnutls_handshake_internal_state_clear().
    */
diff --git a/lib/gnutls_record.c b/lib/gnutls_record.c
index 057a874094..80590d7d6a 100644
--- a/lib/gnutls_record.c
+++ b/lib/gnutls_record.c
@@ -1224,7 +1224,7 @@ begin:
    * is processed and authenticated to avoid someone
    * messing with our windows.
    */
-  if (IS_DTLS(session)) 
+  if (IS_DTLS(session) && session->internals.no_replay_protection == 0)
     {
       ret = _dtls_record_check(record_params, packet_sequence);
       if (ret < 0)
diff --git a/lib/includes/gnutls/dtls.h b/lib/includes/gnutls/dtls.h
index 466f900bd8..2ee71fc3ca 100644
--- a/lib/includes/gnutls/dtls.h
+++ b/lib/includes/gnutls/dtls.h
@@ -81,6 +81,8 @@ unsigned int gnutls_dtls_get_timeout (gnutls_session_t session);
 				 gnutls_dtls_prestate_st* prestate);
 
   unsigned int gnutls_record_get_discarded (gnutls_session_t session);
+  
+  void gnutls_record_disable_replay_protection (gnutls_session_t session);
 #ifdef __cplusplus
 }
 #endif
diff --git a/lib/libgnutls.map b/lib/libgnutls.map
index 5bd384c72f..4a385674f4 100644
--- a/lib/libgnutls.map
+++ b/lib/libgnutls.map
@@ -913,6 +913,7 @@ GNUTLS_3_1_0 {
 	gnutls_session_set_id;
 	gnutls_certificate_set_trust_list;
 	gnutls_cipher_get_tag_size;
+	gnutls_record_disable_replay_protection;
 } GNUTLS_3_0_0;
 
 GNUTLS_PRIVATE {