Added protection against the new TLS 1.0 record layer timing attack.

diff --git a/NEWS b/NEWS
index 6fc313839f49a75b15f9211d9549375e4cd2c1ce..4b6319ead0dde85e8410e2f3d867051882db6cea 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,10 @@ Version 0.9.0
   can now hold only one temporary parameter of a kind.
 - Added a new Certificate, CRL, Private key and PKCS7 structures handling 
   API, defined in gnutls/x509.h
+- Added gnutls_certificate_set_verify_flags() function to allow setting the 
+  verification flags in the credentials structure. They will be used in the
+  *verify_peers functions.
+- Added protection against the new TLS 1.0 record layer timing attack.
 - Added support for Certificate revocation lists. Functions defined
   in gnutls/x509.h
 - The only functions were removed are:

diff --git a/lib/gnutls_cipher.c b/lib/gnutls_cipher.c
index 69787242a67f9adc7c2c2a04362f422924afe766..c31ac04da502ee6795fcca422982194819c1c1ac 100644 (file)
--- a/lib/gnutls_cipher.c
+++ b/lib/gnutls_cipher.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
+ *  Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
  *
  *  This file is part of GNUTLS.
  *
@@ -336,7 +336,7 @@ int _gnutls_ciphertext2compressed(gnutls_session session,
        uint16 length;
        GNUTLS_MAC_HANDLE td;
        uint16 blocksize;
-       int ret, i;
+       int ret, i, pad_failed = 0;
        uint8 major, minor;
        gnutls_protocol_version ver;
        int hash_size = _gnutls_mac_get_digest_size(session->security_parameters.read_mac_algorithm);
@@ -398,7 +398,10 @@ int _gnutls_ciphertext2compressed(gnutls_session session,
                if (pad >
                    ciphertext.size - hash_size) {
                        gnutls_assert();
-                       return GNUTLS_E_DECRYPTION_FAILED;
+                       /* We do not fail here. We check below for the
+                        * the pad_failed. If zero means success.
+                        */
+                       pad_failed = GNUTLS_E_DECRYPTION_FAILED;
                }
                
                /* Check the pading bytes (TLS 1.0 only)
@@ -407,7 +410,7 @@ int _gnutls_ciphertext2compressed(gnutls_session session,
                for (i=2;i<pad;i++) {
                        if (ciphertext.data[ciphertext.size-i] != ciphertext.data[ciphertext.size - 1]) {
                                gnutls_assert();
-                               return GNUTLS_E_DECRYPTION_FAILED;
+                               pad_failed = GNUTLS_E_DECRYPTION_FAILED;
                        }
                }
                
@@ -456,6 +459,11 @@ int _gnutls_ciphertext2compressed(gnutls_session session,
                gnutls_assert();
                return GNUTLS_E_DECRYPTION_FAILED;
        }
+       
+       /* This one was introduced to avoid a timing attack against the TLS
+        * 1.0 protocol.
+        */
+       if (pad_failed != 0) return pad_failed;
 
        return length;
 }

diff --git a/lib/gnutls_cipher_int.c b/lib/gnutls_cipher_int.c
index 49dc86cfb0e0364fcc7faaf96e9d32cca3dbab75..7ca96386a28ac7025382627b3922ca07331a87fb 100644 (file)
--- a/lib/gnutls_cipher_int.c
+++ b/lib/gnutls_cipher_int.c
@@ -1,7 +1,7 @@
 /*
- * Copyright (C) 2000 Nikos Mavroyanopoulos
+ *  Copyright (C) 2000 Nikos Mavroyanopoulos
  *
- * This file is part of GNUTLS.
+ *  This file is part of GNUTLS.
  *
  *  The GNUTLS library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public