[SCM] GNU gnutls branch, master, updated. gnutls_2_11_6-273-g9ab04f5

[Nikos Mavrogiannopoulos]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU gnutls".

http://git.savannah.gnu.org/cgit/gnutls.git/commit/?id=9ab04f58304603c5c5f2d69e8e51cd378d75e8a7

The branch, master has been updated
       via  9ab04f58304603c5c5f2d69e8e51cd378d75e8a7 (commit)
       via  ec62cab9b92cbb29f09cf237cdfc8dcec5b07aac (commit)
      from  b0a2bb980b403077656f39d79d3fc796407cd7e8 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 9ab04f58304603c5c5f2d69e8e51cd378d75e8a7
Author: Nikos Mavrogiannopoulos <address@hidden>
Date:   Fri Mar 11 00:15:55 2011 +0100

    Corrected size check in block encrypted records.

commit ec62cab9b92cbb29f09cf237cdfc8dcec5b07aac
Author: Nikos Mavrogiannopoulos <address@hidden>
Date:   Thu Mar 10 23:58:27 2011 +0100

    Corrected behavior in normal TLS handshake.

-----------------------------------------------------------------------

Summary of changes:
 lib/gnutls_buffers.c   |   29 ++++++++++++++++++++---------
 lib/gnutls_cipher.c    |    2 +-
 lib/gnutls_handshake.c |    7 +++++++
 3 files changed, 28 insertions(+), 10 deletions(-)

diff --git a/lib/gnutls_buffers.c b/lib/gnutls_buffers.c
index c8ad1dc..55a7665 100644
--- a/lib/gnutls_buffers.c
+++ b/lib/gnutls_buffers.c
@@ -1008,7 +1008,10 @@ handshake_buffer_st* recv_buf = 
session->internals.handshake_recv_buffer;
         return gnutls_assert_val(GNUTLS_E_AGAIN);
 
       if (htype != recv_buf[LAST_ELEMENT].htype)
-        return gnutls_assert_val(GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET);
+        {
+          hsk->htype = recv_buf[LAST_ELEMENT].htype;
+          return gnutls_assert_val(GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET);
+        }
 
       else if ((recv_buf[LAST_ELEMENT].start_offset == 0 &&
         recv_buf[LAST_ELEMENT].end_offset == recv_buf[LAST_ELEMENT].length -1) 
|| 
@@ -1017,7 +1020,6 @@ handshake_buffer_st* recv_buf = 
session->internals.handshake_recv_buffer;
           session->internals.dtls.hsk_read_seq++;
           _gnutls_handshake_buffer_move(hsk, &recv_buf[LAST_ELEMENT]);
           session->internals.handshake_recv_buffer_size--;
-
           return 0;
         }
       else
@@ -1027,11 +1029,18 @@ handshake_buffer_st* recv_buf = 
session->internals.handshake_recv_buffer;
     {
       if (session->internals.handshake_recv_buffer_size > 0 && 
recv_buf[0].length == recv_buf[0].data.length)
         {
+          if (recv_buf[0].htype != htype)
+            {
+              hsk->htype = recv_buf[LAST_ELEMENT].htype;
+              return gnutls_assert_val(GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET);
+            }
+
           _gnutls_handshake_buffer_move(hsk, &recv_buf[0]);
+          session->internals.handshake_recv_buffer_size--;
           return 0;
         }
       else
-        return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+        return gnutls_assert_val(GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE);
     }
 }
 
@@ -1078,7 +1087,7 @@ _gnutls_handshake_io_recv_int (gnutls_session_t session,
                 recv_buf[0].data.length;
 
           /* this is the rest of a previous message */
-          if (recv_buf[0].length > 0 && remain > 0)
+          if (session->internals.handshake_recv_buffer_size > 0 && 
recv_buf[0].length > 0 && remain > 0)
             {
               if (msg.size <= remain)
                 append = msg.size;
@@ -1100,11 +1109,6 @@ _gnutls_handshake_io_recv_int (gnutls_session_t session,
               header_size = ret;
               session->internals.handshake_recv_buffer_size = 1;
 
-              if (htype != recv_buf[0].htype)
-                { /* an unexpected packet */
-                  return 
gnutls_assert_val(GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET);
-                }
-
               _mbuffer_set_uhead_size(bufel, header_size);
 
               data_size = MIN(recv_buf[0].length, 
_mbuffer_get_udata_size(bufel));
@@ -1113,6 +1117,13 @@ _gnutls_handshake_io_recv_int (gnutls_session_t session,
                 return gnutls_assert_val(ret);
 
               _mbuffer_head_remove_bytes(&session->internals.record_buffer, 
data_size+header_size);
+
+              if (htype != recv_buf[0].htype)
+                { /* an unexpected packet */
+                  hsk->htype = recv_buf[0].htype;
+                  return 
gnutls_assert_val(GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET);
+                }
+
             }
 
           /* if packet is complete then return it
diff --git a/lib/gnutls_cipher.c b/lib/gnutls_cipher.c
index d355151..deef202 100644
--- a/lib/gnutls_cipher.c
+++ b/lib/gnutls_cipher.c
@@ -519,7 +519,7 @@ _gnutls_ciphertext2compressed (gnutls_session_t session,
 
       break;
     case CIPHER_BLOCK:
-      if ((ciphertext.size < blocksize+tag_size) || (ciphertext.size % 
blocksize != 0))
+      if (ciphertext.size < MAX(blocksize, tag_size) || (ciphertext.size % 
blocksize != 0))
         return gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
 
       /* ignore the IV in TLS 1.1+
diff --git a/lib/gnutls_handshake.c b/lib/gnutls_handshake.c
index d8dcea4..6b7f1d3 100644
--- a/lib/gnutls_handshake.c
+++ b/lib/gnutls_handshake.c
@@ -1354,6 +1354,10 @@ _gnutls_recv_handshake (gnutls_session_t session,
           if (buf) _gnutls_buffer_init(buf);
           return 0;
         }
+
+       _gnutls_audit_log("Received unexpected handshake message '%s' (%d). 
Expected '%s' (%d)\n",
+         _gnutls_handshake2str(hsk.htype), (int)hsk.htype, 
_gnutls_handshake2str(type), (int)type);
+
       return gnutls_assert_val(ret);
     }
 
@@ -1430,6 +1434,9 @@ _gnutls_recv_handshake (gnutls_session_t session,
       break;
     default:
       gnutls_assert ();
+      /* we shouldn't actually arrive here in any case .
+       * unexpected messages should be catched after 
_gnutls_handshake_io_recv_int()
+       */
       ret = GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET;
       goto cleanup;
     }


hooks/post-receive
-- 
GNU gnutls