Increase max handshake packet size. Add new error code for situation.

Thanks to Marc Haber <mh+debian-bugs@zugschlus.de> and "Marc F.
Clemente" <marc@mclemente.net> for reporting and providing test servers.

diff --git a/NEWS b/NEWS
index 67f2a7fb92bf96efc437b36bd085e1821d57d5cd..d8ca448869ce7d523bd06f94b3202206c778e4c9 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,17 @@ See the end for copying conditions.
 
 * Version 2.3.8 (unreleased)
 
+** Increase default handshake packet size limit to 48kb.
+The old limit was 16kb and some servers send huge list of trusted CAs,
+thus running into the limit.  FYI, applications can further increase
+this limit using gnutls_handshake_set_max_packet_length.  Thanks to
+Marc Haber <mh+debian-bugs@zugschlus.de> and "Marc F. Clemente"
+<marc@mclemente.net> for reporting and providing test servers.
+
+** Add new error code when handshake is too large: GNUTLS_E_HANDSHAKE_TOO_LARGE
+Before GNUTLS_E_MEMORY_ERROR was used, which could be confused with
+other error situations.
+
 ** Hide definitions in crypto.h.
 We have decided that the APIs defined in crypto.h are not stable
 enough for v2.4, so don't use any of those functions.
@@ -15,7 +26,7 @@ correct name is found.
 ** Update of gnulib files.
 
 ** API and ABI modifications:
-No changes since last version.
+GNUTLS_E_HANDSHAKE_TOO_LARGE: ADDED.
 
 * Version 2.3.7 (released 2008-04-21)
 

diff --git a/includes/gnutls/gnutls.h.in b/includes/gnutls/gnutls.h.in
index 835b9fa7381d485b7d0437a45d333635c922e2ed..2fe6493e237d59eb0a524c9637a500857bef6123 100644 (file)
--- a/includes/gnutls/gnutls.h.in
+++ b/includes/gnutls/gnutls.h.in
@@ -1308,6 +1308,8 @@ extern "C"
 
 #define GNUTLS_E_CRYPTO_ALREADY_REGISTERED -209
 
+#define GNUTLS_E_HANDSHAKE_TOO_LARGE -210
+
 #define GNUTLS_E_UNIMPLEMENTED_FEATURE -1250
 
 #define GNUTLS_E_APPLICATION_ERROR_MAX -65000

diff --git a/lib/gnutls_buffers.c b/lib/gnutls_buffers.c
index 2caf266599221995fe0c78d4b658815250f6a81b..8d9be9cf2db47ee711ace63dc9caf8bfefe92ccc 100644 (file)
--- a/lib/gnutls_buffers.c
+++ b/lib/gnutls_buffers.c
@@ -1185,7 +1185,7 @@ _gnutls_handshake_buffer_put (gnutls_session_t session, opaque * data,
        session->internals.max_handshake_data_buffer_size))
     {
       gnutls_assert ();
-      return GNUTLS_E_MEMORY_ERROR;
+      return GNUTLS_E_HANDSHAKE_TOO_LARGE;
     }
 
   _gnutls_buffers_log ("BUF[HSK]: Inserted %d bytes of Data\n", length);

diff --git a/lib/gnutls_errors.c b/lib/gnutls_errors.c
index 707fc00e1b95352884ac58749862cd15e69fda26..456e31d718c88ed39c9c9fd34d40be56208cb256 100644 (file)
--- a/lib/gnutls_errors.c
+++ b/lib/gnutls_errors.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation
  *
  * Author: Nikos Mavrogiannopoulos
  *
@@ -249,6 +249,10 @@ static const gnutls_error_entry error_algorithms[] = {
   ERROR_ENTRY (N_("The specified algorithm or protocol is unknown."),
               GNUTLS_E_UNKNOWN_ALGORITHM, 1),
 
+  ERROR_ENTRY (N_("The handshake data size is too large (DoS?), "
+                 "check gnutls_handshake_set_max_packet_length()."),
+              GNUTLS_E_HANDSHAKE_TOO_LARGE, 1),
+
   {NULL, NULL, 0, 0}
 };
 

diff --git a/lib/gnutls_handshake.c b/lib/gnutls_handshake.c
index 98aa86cb8fccb4faf2bd07e76dd60176838c9d12..39607a84a2460e43399e09d6b724d23497a45e83 100644 (file)
--- a/lib/gnutls_handshake.c
+++ b/lib/gnutls_handshake.c
@@ -2961,9 +2961,11 @@ _gnutls_remove_unwanted_ciphersuites (gnutls_session_t session,
   *
   * This function will set the maximum size of a handshake message.
   * Handshake messages over this size are rejected.  The default value
-  * is 16kb which is large enough. Set this to 0 if you do not want to
-  * set an upper limit.
+  * is 48kb which is typically large enough. Set this to 0 if you do
+  * not want to set an upper limit.
   *
+  * The reason for restricting the handshake message sizes are to
+  * limit Denial of Service attacks.
   **/
 void
 gnutls_handshake_set_max_packet_length (gnutls_session_t session, size_t max)

diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index e37237d33cae281b649849f436ba1aa7cbc29bc6..8c3ff46ac1e9ab4c510dea4e6c918639cdb79cf6 100644 (file)
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation
  *
  * Author: Nikos Mavrogiannopoulos
  *
@@ -47,7 +47,7 @@
 /* The size of a handshake message should not
  * be larger than this value.
  */
-#define MAX_HANDSHAKE_PACKET_SIZE 16*1024
+#define MAX_HANDSHAKE_PACKET_SIZE 48*1024
 
 #define TLS_RANDOM_SIZE 32
 #define TLS_MAX_SESSION_ID_SIZE 32