Added protection against denial of service attacks, while receiving

empty packets.

diff --git a/lib/gnutls_errors.c b/lib/gnutls_errors.c
index 0c198091d3b268099be442fa1422a88d5193031c..526114c2a88dc41a55281b0ef7297a6ca18a8ae3 100644 (file)
--- a/lib/gnutls_errors.c
+++ b/lib/gnutls_errors.c
@@ -112,6 +112,7 @@ static gnutls_error_entry error_algorithms[] = {
        GNUTLS_ERROR_ENTRY( GNUTLS_E_ASN1_TYPE_ANY_ERROR, 1),
        GNUTLS_ERROR_ENTRY( GNUTLS_E_ASN1_SYNTAX_ERROR, 1),
        GNUTLS_ERROR_ENTRY( GNUTLS_E_ASN1_DER_OVERFLOW, 1),
+       GNUTLS_ERROR_ENTRY( GNUTLS_E_TOO_MANY_EMPTY_PACKETS, 1),
        {0}
 };
 

diff --git a/lib/gnutls_errors_int.h b/lib/gnutls_errors_int.h
index 0c8493e341c2ec3e14aedd79bbd0e9c3273fb896..065473798930a512001182ec91eee32a3dee6bab 100644 (file)
--- a/lib/gnutls_errors_int.h
+++ b/lib/gnutls_errors_int.h
@@ -75,6 +75,7 @@
 #define GNUTLS_E_ASN1_TYPE_ANY_ERROR -75
 #define GNUTLS_E_ASN1_SYNTAX_ERROR -76
 #define GNUTLS_E_ASN1_DER_OVERFLOW -77
+#define GNUTLS_E_TOO_MANY_EMPTY_PACKETS -78
 
 #define GNUTLS_E_UNIMPLEMENTED_FEATURE -250
 

diff --git a/lib/gnutls_record.c b/lib/gnutls_record.c
index 6c23e0faf9b263ee5d07a76254df434b8d145479..7d1fe00a305a1585ee5518bad7175532eddb418e 100644 (file)
--- a/lib/gnutls_record.c
+++ b/lib/gnutls_record.c
@@ -722,6 +722,8 @@ static int _gnutls_record_check_type( GNUTLS_STATE state, ContentType recv_type,
 
 }
 
+#define MAX_EMPTY_PACKETS_SEQUENCE 4
+
 /* This function behave exactly like read(). The only difference is 
  * that it accepts, the gnutls_state and the ContentType of data to
  * send (if called by the user the Content is Userdata only)
@@ -739,8 +741,15 @@ ssize_t gnutls_recv_int( GNUTLS_STATE state, ContentType type, HandshakeType hty
        uint8 *recv_data;
        int ret, ret2;
        uint16 header_size;
+       int empty_packet = 0;
 
        begin:
+       
+       if (empty_packet > MAX_EMPTY_PACKETS_SEQUENCE) {
+               gnutls_assert();
+               return GNUTLS_E_TOO_MANY_EMPTY_PACKETS;
+       }
+       
        /* default headers for TLS 1.0
         */
        header_size = RECORD_HEADER_SIZE;
@@ -905,8 +914,11 @@ ssize_t gnutls_recv_int( GNUTLS_STATE state, ContentType type, HandshakeType hty
 
        /* TLS 1.0 CBC protection. Read the next fragment.
         */
-       if (ret==0) goto begin;
-
+       if (ret==0) {
+               empty_packet++;
+               goto begin;
+       }
+       
        return ret;
 }