The library notifies the application on empty and illegal SRP usernames,

so that proper notification (via an alert) is sent to the peer. Currently when
the SRP ciphersuite is advertized but no username is sent by the peer, the
library returns GNUTLS_E_EMPTY_SRP_USERNAME, and the alert associated with
this is GNUTLS_A_ACCESS_DENIED (to be changed when the srp draft defines something
more appropriate).

diff --git a/NEWS b/NEWS
index eb1430dcd0610b10d1bcaafce06030bf93c17d69..d6e402e04db3839660cbbc1214348c41b82a336c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,10 +1,14 @@
-Version 0.8.1
+Version 0.8.2
+- The library notifies the application on empty and illegal SRP usernames, 
+  so that proper notification (via an alert) is sent to the peer.
+
+Version 0.8.1 (22/01/2003)
 - Improved the SRP support, to prevent attackers guessing the
   available usernames by brute force.
 - Improved the SRP detection in gnutls-cli-debug
 - Some fixes which now allow compilation.
 
-Version 0.8.0 (20/01/2002)
+Version 0.8.0 (20/01/2003)
 - Added gnutls_x509_extract_dn_string() which returns a 
   distinguished name in a single string.
 - Added gnutls_openpgp_extract_key_name_string() which returns

diff --git a/lib/gnutls_alert.c b/lib/gnutls_alert.c
index e7d826945190d6a30f8facc0574340e9de78b56a..b3060dc469e24cc6bdfc9ee1e2508289eb83138b 100644 (file)
--- a/lib/gnutls_alert.c
+++ b/lib/gnutls_alert.c
@@ -140,6 +140,10 @@ int _level = -1;
                        ret = GNUTLS_A_BAD_RECORD_MAC;
                        _level = GNUTLS_AL_FATAL;
                        break;
+               case GNUTLS_E_ILLEGAL_SRP_USERNAME:
+                       ret = GNUTLS_A_ACCESS_DENIED;
+                       _level = GNUTLS_AL_FATAL;
+                       break;
                case GNUTLS_E_DECOMPRESSION_FAILED:
                        ret = GNUTLS_A_DECOMPRESSION_FAILURE;
                        _level = GNUTLS_AL_FATAL;

diff --git a/lib/gnutls_auth_int.h b/lib/gnutls_auth_int.h
index a62de075659f9b8e7a7bc7b2b23c17c5a11e53d3..becdd875056b1b699bb18b4277bcdd92271149b9 100644 (file)
--- a/lib/gnutls_auth_int.h
+++ b/lib/gnutls_auth_int.h
@@ -1,4 +1,4 @@
-int gnutls_clear_creds( gnutls_session session);
+void gnutls_credentials_clear( gnutls_session session);
 int gnutls_credentials_set( gnutls_session session, gnutls_credentials_type type, void* cred);
 const void *_gnutls_get_cred( GNUTLS_KEY key, gnutls_credentials_type kx, int* err);
 const void *_gnutls_get_kx_cred( gnutls_session session, gnutls_kx_algorithm algo, int *err);

diff --git a/lib/gnutls_handshake.c b/lib/gnutls_handshake.c
index 506dab71049884e37a1565d1768564fba4289a06..54ef95434b55c80a0ee33e7ceffd6c5188293ac0 100644 (file)
--- a/lib/gnutls_handshake.c
+++ b/lib/gnutls_handshake.c
@@ -2325,7 +2325,6 @@ int _gnutls_remove_unwanted_ciphersuites(gnutls_session session,
        if (cert == NULL) {
                /* No certificate was found 
                 */
-               gnutls_assert();
                alg_size = 0;
                alg = NULL;
        } else {

diff --git a/libextra/auth_srp.c b/libextra/auth_srp.c
index c613ea31d237ea72b776710b0811a6b5d98f077a..84d47cb49b33ddadbf3f5277423e16cd02e6b026 100644 (file)
--- a/libextra/auth_srp.c
+++ b/libextra/auth_srp.c
@@ -75,12 +75,19 @@ int _gnutls_gen_srp_server_kx(gnutls_session state, opaque ** data)
        uint8 *data_n, *data_s;
        uint8 *data_g, *username;
        SRP_PWD_ENTRY *pwd_entry;
-       int err;
        SRP_SERVER_AUTH_INFO info;
        ssize_t data_size;
        size_t n_b;
        uint8 *data_b;
-       
+
+       if (state->security_parameters.extensions.srp_username[0] == 0) {
+               /* The peer didn't send a valid SRP extension with the
+                * SRP username.
+                */
+               gnutls_assert();
+               return GNUTLS_E_EMPTY_SRP_USERNAME;
+       }
+
        if ( (ret=_gnutls_auth_info_set( state, GNUTLS_CRD_SRP, sizeof( SRP_SERVER_AUTH_INFO_INT), 1)) < 0) {
                gnutls_assert();
                return ret;
@@ -88,7 +95,7 @@ int _gnutls_gen_srp_server_kx(gnutls_session state, opaque ** data)
 
        info = _gnutls_get_auth_info( state);
        username = info->username;
-       
+
        _gnutls_str_cpy( username, MAX_SRP_USERNAME, state->security_parameters.extensions.srp_username);
 
        ret = _gnutls_srp_pwd_read_entry( state, username, &pwd_entry);

diff --git a/libextra/auth_srp_passwd.c b/libextra/auth_srp_passwd.c
index 7504df996371c842f8d49f31517f76319191b6f8..e11b7aa0a7cd0de21969bf6334040e7782cf4e71 100644 (file)
--- a/libextra/auth_srp_passwd.c
+++ b/libextra/auth_srp_passwd.c
@@ -369,7 +369,7 @@ unsigned char rndsuffix[5];
        _gnutls_get_random( rndsuffix, sizeof(rndsuffix), GNUTLS_WEAK_RANDOM);
        sprintf( rnduser, "__invalid%x%x%x%x", rndsuffix[0], 
                rndsuffix[1], rndsuffix[2], rndsuffix[3]);
-       entry->salt.size = (rndsuffix[4] % 10) + 7;
+       entry->salt.size = (rndsuffix[4] % 10) + 9;
 
        entry->username = gnutls_strdup(rnduser);
        if (entry->username == NULL) {

diff --git a/libextra/ext_srp.c b/libextra/ext_srp.c
index 3624af2a2136763080e130791fb72b9602cd8cf7..99cc0fbef2529a35c5706815c821fe900a65b596 100644 (file)
--- a/libextra/ext_srp.c
+++ b/libextra/ext_srp.c
@@ -47,7 +47,7 @@ int _gnutls_srp_recv_params( gnutls_session state, const opaque* data, size_t _d
 
                        if ( sizeof( state->security_parameters.extensions.srp_username) <= len) {
                                gnutls_assert();
-                               return GNUTLS_E_MEMORY_ERROR;
+                               return GNUTLS_E_ILLEGAL_SRP_USERNAME;
                        }
                        memcpy( state->security_parameters.extensions.srp_username, &data[1], len);
                        state->security_parameters.extensions.srp_username[len]=0; /* null terminated */

diff --git a/libextra/gnutls_openpgp.c b/libextra/gnutls_openpgp.c
index 99111f1326d7ba1025060b661ad50d33e9845ac4..1128bf8ee53d5b83d0642d5c520c04b6927058d6 100644 (file)
--- a/libextra/gnutls_openpgp.c
+++ b/libextra/gnutls_openpgp.c
@@ -911,8 +911,7 @@ gnutls_openpgp_extract_key_name_string( const gnutls_datum *cert,
     CDK_KBNODE knode = NULL, ctx = NULL, p;
     CDK_PACKET *pkt = NULL;
     cdkPKT_user_id *uid = NULL;
-    char *email;
-    int pos = 0, pos1 = 0, pos2 = 0;
+    int pos = 0;
     size_t size = 0;
     int rc = 0;
 

diff --git a/src/cli.c b/src/cli.c
index f6f5f00997fa0684ce3a5b6965ec4e8641a141cc..2b888c037104ac74a9ee0762f854971077c02d18 100644 (file)
--- a/src/cli.c
+++ b/src/cli.c
@@ -70,7 +70,7 @@ char *x509_cafile;
 char *x509_crlfile = NULL;
 static int x509ctype;
 
-static gnutls_srp_client_credentials cred;
+static gnutls_srp_client_credentials srp_cred;
 static gnutls_anon_client_credentials anon_cred;
 static gnutls_certificate_credentials xcred;
 
@@ -143,8 +143,7 @@ static gnutls_session init_tls_session( const char* hostname)
    gnutls_dh_set_prime_bits(session, 512);
 
    gnutls_credentials_set(session, GNUTLS_CRD_ANON, anon_cred);
-   if (srp_username != NULL)
-      gnutls_credentials_set(session, GNUTLS_CRD_SRP, cred);
+   gnutls_credentials_set(session, GNUTLS_CRD_SRP, srp_cred);
    gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
 
    /* send the fingerprint */
@@ -362,8 +361,7 @@ int main(int argc, char **argv)
       socket_bye(&hd);
 
 
-   if (srp_username != NULL)
-      gnutls_srp_free_client_credentials(cred);
+   gnutls_srp_free_client_credentials(srp_cred);
    gnutls_certificate_free_credentials(xcred);
    gnutls_anon_free_client_credentials(anon_cred);
 
@@ -642,12 +640,12 @@ int ret;
 /*     gnutls_certificate_client_callback_func( xcred, cert_callback); */
 
    /* SRP stuff */
-   if (srp_username != NULL) {
-      if (gnutls_srp_allocate_client_credentials(&cred) < 0) {
-        fprintf(stderr, "SRP authentication error\n");
-      }
+   if (gnutls_srp_allocate_client_credentials(&srp_cred) < 0) {
+       fprintf(stderr, "SRP authentication error\n");
+   }
 
-      if ((ret=gnutls_srp_set_client_credentials(cred, srp_username, srp_passwd)) < 0) {
+   if (srp_username != NULL) {
+      if ((ret=gnutls_srp_set_client_credentials(srp_cred, srp_username, srp_passwd)) < 0) {
         fprintf(stderr, "SRP credentials set error [%d]\n", ret);
       }
    }