DTLS replay protection can now be disabled.

diff --git a/NEWS b/NEWS
index e372571dc2ee0032af8cb48dbb8881f271701366..c08b6bba075d82202340166138ea22c57e4b076f 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -7,9 +7,12 @@ See the end for copying conditions.
 ** libgnutls: Several optimizations in the related to packet processing
 subsystems.
 
+** libgnutls: DTLS replay protection can now be disabled.
+
 ** API and ABI modifications:
 gnutls_certificate_set_trust_list: Added
 gnutls_cipher_get_tag_size: Added
+gnutls_record_disable_replay_protection: Added
 
 
 * Version 3.2.1 (released 2013-06-01)

diff --git a/lib/gnutls_dtls.c b/lib/gnutls_dtls.c
index 2f3bcdc738db6fbe80a15a55583eb94e8e0acee7..bf76521a6980f0729d4dc8337109b945adaf1461 100644 (file)
--- a/lib/gnutls_dtls.c
+++ b/lib/gnutls_dtls.c
@@ -1014,3 +1014,17 @@ unsigned int gnutls_record_get_discarded (gnutls_session_t session)
   return session->internals.dtls.packets_dropped;
 }
 
+/**
+ * gnutls_record_disable_replay_protection:
+ * @session: is a #gnutls_session_t structure.
+ *
+ * This function will disable any replay protection in DTLS mode.
+ * That must only used when replay protection is achieved using
+ * other means.
+ *
+ **/
+void
+gnutls_record_disable_replay_protection (gnutls_session_t session)
+{
+  session->internals.no_replay_protection = 1;
+}

diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index c128c67306835c709b40fe9d36db47d19cf2533e..8c6766c8f241e407c81f0278dd9e2a8d75ce2c4d 100644 (file)
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -997,6 +997,7 @@ typedef struct
   recv_state_t recv_state; /* state of the receive function */
   
   unsigned int sc_random_set:1;
+  unsigned int no_replay_protection:1; /* DTLS replay protection */
   
   /* If you add anything here, check _gnutls_handshake_internal_state_clear().
    */

diff --git a/lib/gnutls_record.c b/lib/gnutls_record.c
index 057a874094b2dde0a5ac799eefe60e789de9979f..80590d7d6a7232c650ae8a52156d894c851daf5f 100644 (file)
--- a/lib/gnutls_record.c
+++ b/lib/gnutls_record.c
@@ -1224,7 +1224,7 @@ begin:
    * is processed and authenticated to avoid someone
    * messing with our windows.
    */
-  if (IS_DTLS(session)) 
+  if (IS_DTLS(session) && session->internals.no_replay_protection == 0)
     {
       ret = _dtls_record_check(record_params, packet_sequence);
       if (ret < 0)

diff --git a/lib/includes/gnutls/dtls.h b/lib/includes/gnutls/dtls.h
index 466f900bd81c844105fef3e1530623b04d16446d..2ee71fc3ca853d813b83f2d7a36932fe8bd54622 100644 (file)
--- a/lib/includes/gnutls/dtls.h
+++ b/lib/includes/gnutls/dtls.h
@@ -81,6 +81,8 @@ unsigned int gnutls_dtls_get_timeout (gnutls_session_t session);
                                 gnutls_dtls_prestate_st* prestate);
 
   unsigned int gnutls_record_get_discarded (gnutls_session_t session);
+  
+  void gnutls_record_disable_replay_protection (gnutls_session_t session);
 #ifdef __cplusplus
 }
 #endif

diff --git a/lib/libgnutls.map b/lib/libgnutls.map
index 5bd384c72f9def888ce83acbb6fa7994eee5192e..4a385674f4f2f4049e177e141f45104544f65cc5 100644 (file)
--- a/lib/libgnutls.map
+++ b/lib/libgnutls.map
@@ -913,6 +913,7 @@ GNUTLS_3_1_0 {
        gnutls_session_set_id;
        gnutls_certificate_set_trust_list;
        gnutls_cipher_get_tag_size;
+       gnutls_record_disable_replay_protection;
 } GNUTLS_3_0_0;
 
 GNUTLS_PRIVATE {