Avoid sending alerts during handshake. Alerts might be interrupted and return

a non-fatal error which will propagate and in many cases it shouldn't.

Avoid sending no renegotiation alert when a client connects to an unsafe server. Thanks
to Tomas Hoger for the report.

diff --git a/lib/gnutls_alert.c b/lib/gnutls_alert.c
index f4c52875c55893f3fde5cea4121c09412168ef1d..71aae45f5cb6bb4a5deedd14da334a80aac1634e 100644 (file)
--- a/lib/gnutls_alert.c
+++ b/lib/gnutls_alert.c
@@ -181,6 +181,10 @@ gnutls_error_to_alert (int err, int *level)
       ret = GNUTLS_A_ILLEGAL_PARAMETER;
       _level = GNUTLS_AL_FATAL;
       break;
+    case GNUTLS_E_UNKNOWN_SRP_USERNAME:
+      ret = GNUTLS_A_UNKNOWN_PSK_IDENTITY;
+      _level = GNUTLS_AL_FATAL;
+      break;
     case GNUTLS_E_ASN1_ELEMENT_NOT_FOUND:
     case GNUTLS_E_ASN1_IDENTIFIER_NOT_FOUND:
     case GNUTLS_E_ASN1_DER_ERROR:
@@ -215,6 +219,7 @@ gnutls_error_to_alert (int err, int *level)
       _level = GNUTLS_AL_FATAL;
       break;
     case GNUTLS_E_REHANDSHAKE:
+    case GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED:
       ret = GNUTLS_A_NO_RENEGOTIATION;
       _level = GNUTLS_AL_WARNING;
       break;

diff --git a/lib/gnutls_errors.c b/lib/gnutls_errors.c
index 69d92ad2de708021c6a3051fb25878180ad7e925..21f40b1cc12dfd8bf2ac61c3760496ff3a9a38e6 100644 (file)
--- a/lib/gnutls_errors.c
+++ b/lib/gnutls_errors.c
@@ -223,9 +223,13 @@ static const gnutls_error_entry error_algorithms[] = {
               GNUTLS_E_OPENPGP_SUBKEY_ERROR, 1),
   ERROR_ENTRY (N_("Safe renegotiation failed."),
               GNUTLS_E_SAFE_RENEGOTIATION_FAILED, 1),
+  ERROR_ENTRY (N_("Unsafe renegotiation denied."),
+              GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED, 1),
 
   ERROR_ENTRY (N_("The SRP username supplied is illegal."),
               GNUTLS_E_ILLEGAL_SRP_USERNAME, 1),
+  ERROR_ENTRY (N_("The SRP username supplied is unknown."),
+              GNUTLS_E_UNKNOWN_SRP_USERNAME, 1),
 
   ERROR_ENTRY (N_("The OpenPGP fingerprint is not supported."),
               GNUTLS_E_OPENPGP_FINGERPRINT_UNSUPPORTED, 1),

diff --git a/lib/gnutls_handshake.c b/lib/gnutls_handshake.c
index 4e2952a405d614ff899af846d0a54907039d928a..2ed4f5cae423e698fd0fd6fd64283719a9cd9b2a 100644 (file)
--- a/lib/gnutls_handshake.c
+++ b/lib/gnutls_handshake.c
@@ -2248,15 +2248,7 @@ _gnutls_send_server_hello (gnutls_session_t session, int again)
           * alert and abort.
           */
          gnutls_assert ();
-         ret = gnutls_alert_send (session, GNUTLS_AL_FATAL,
-                                  GNUTLS_A_UNKNOWN_PSK_IDENTITY);
-         if (ret < 0)
-           {
-             gnutls_assert ();
-             return ret;
-           }
-
-         return GNUTLS_E_ILLEGAL_SRP_USERNAME;
+         return GNUTLS_E_UNKNOWN_SRP_USERNAME;
        }
     }
 #endif
@@ -2435,22 +2427,16 @@ _gnutls_recv_hello (gnutls_session_t session, opaque * data, int datalen)
        {
          if (session->internals.priorities.unsafe_renegotiation != 0)
            {
-             _gnutls_handshake_log ("Allowing unsafe renegotiation!\n");
+             _gnutls_handshake_log ("Allowing unsafe (re)negotiation!\n");
            }
          else
            {
              gnutls_assert();
-             _gnutls_handshake_log ("Denying unsafe renegotiation.\n");
-             ret = gnutls_alert_send (session, GNUTLS_AL_WARNING,
-                                  GNUTLS_A_NO_RENEGOTIATION);
-
-             if (ret < 0)
-               {
-                 gnutls_assert ();
-                 return ret;
-               }
-
-             return GNUTLS_E_SAFE_RENEGOTIATION_FAILED;
+             _gnutls_handshake_log ("Denying unsafe (re)negotiation.\n");
+             if (session->security_parameters.entity == GNUTLS_SERVER)
+               return GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED; /* send no renegotiation alert */
+              else
+               return GNUTLS_E_SAFE_RENEGOTIATION_FAILED;
            }
        }
       else

diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in
index c3b62623209d4f8f27623ce95a1b2df6675d10d1..8f3d828b088e898b25d691464bb5cbfca146ce09 100644 (file)
--- a/lib/includes/gnutls/gnutls.h.in
+++ b/lib/includes/gnutls/gnutls.h.in
@@ -1685,6 +1685,8 @@ extern "C" {
 #define GNUTLS_E_UNKNOWN_ALGORITHM -105
 #define GNUTLS_E_UNSUPPORTED_SIGNATURE_ALGORITHM -106
 #define GNUTLS_E_SAFE_RENEGOTIATION_FAILED -107
+#define GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED -108
+#define GNUTLS_E_UNKNOWN_SRP_USERNAME -109
 
 #define GNUTLS_E_BASE64_ENCODING_ERROR -201
 #define GNUTLS_E_INCOMPATIBLE_GCRYPT_LIBRARY -202      /* obsolete */