|
 |
17c662 |
diff --git a/lib/gnutls_cipher.c b/lib/gnutls_cipher.c
|
|
|
17c662 |
index 37478a4c3..65dde6899 100644
|
|
|
17c662 |
--- a/lib/gnutls_cipher.c
|
|
|
17c662 |
+++ b/lib/gnutls_cipher.c
|
|
|
17c662 |
@@ -434,40 +434,41 @@ compressed_to_ciphertext(gnutls_session_t session,
|
|
|
17c662 |
return length;
|
|
|
17c662 |
}
|
|
|
17c662 |
|
|
|
17c662 |
-static void dummy_wait(record_parameters_st * params,
|
|
|
17c662 |
- gnutls_datum_t * plaintext, unsigned pad_failed,
|
|
|
17c662 |
- unsigned int pad, unsigned total)
|
|
|
17c662 |
+static void dummy_wait(record_parameters_st *params,
|
|
|
17c662 |
+ gnutls_datum_t *plaintext,
|
|
|
17c662 |
+ unsigned int mac_data, unsigned int max_mac_data)
|
|
|
17c662 |
{
|
|
|
17c662 |
/* this hack is only needed on CBC ciphers */
|
|
|
17c662 |
if (_gnutls_cipher_is_block(params->cipher) == CIPHER_BLOCK) {
|
|
|
17c662 |
- unsigned len, v;
|
|
|
17c662 |
+ unsigned v;
|
|
|
17c662 |
+ unsigned int tag_size =
|
|
|
17c662 |
+ _gnutls_auth_cipher_tag_len(¶ms->read.cipher_state);
|
|
|
17c662 |
+ unsigned hash_block = _gnutls_mac_block_size(params->mac);
|
|
|
17c662 |
|
|
|
17c662 |
- /* force an additional hash compression function evaluation to prevent timing
|
|
|
17c662 |
+ /* force additional hash compression function evaluations to prevent timing
|
|
|
17c662 |
* attacks that distinguish between wrong-mac + correct pad, from wrong-mac + incorrect pad.
|
|
|
17c662 |
*/
|
|
|
17c662 |
- if (pad_failed == 0 && pad > 0) {
|
|
|
17c662 |
- len = _gnutls_mac_block_size(params->mac);
|
|
|
17c662 |
- if (len > 0) {
|
|
|
17c662 |
- if (params->mac && params->mac->id == GNUTLS_MAC_SHA384)
|
|
|
17c662 |
- /* v = 1 for the hash function padding + 16 for message length */
|
|
|
17c662 |
- v = 17;
|
|
|
17c662 |
- else /* v = 1 for the hash function padding + 8 for message length */
|
|
|
17c662 |
- v = 9;
|
|
|
17c662 |
-
|
|
|
17c662 |
- if ((pad + total) % len > len - v
|
|
|
17c662 |
- && total % len <= len - v) {
|
|
|
17c662 |
- if (len < plaintext->size)
|
|
|
17c662 |
- _gnutls_auth_cipher_add_auth
|
|
|
17c662 |
- (¶ms->read.
|
|
|
17c662 |
- cipher_state,
|
|
|
17c662 |
- plaintext->data, len);
|
|
|
17c662 |
- else
|
|
|
17c662 |
- _gnutls_auth_cipher_add_auth
|
|
|
17c662 |
- (¶ms->read.
|
|
|
17c662 |
- cipher_state,
|
|
|
17c662 |
- plaintext->data,
|
|
|
17c662 |
- plaintext->size);
|
|
|
17c662 |
- }
|
|
|
17c662 |
+ if (params->mac && params->mac->id == GNUTLS_MAC_SHA384)
|
|
|
17c662 |
+ /* v = 1 for the hash function padding + 16 for message length */
|
|
|
17c662 |
+ v = 17;
|
|
|
17c662 |
+ else /* v = 1 for the hash function padding + 8 for message length */
|
|
|
17c662 |
+ v = 9;
|
|
|
17c662 |
+
|
|
|
17c662 |
+ if (hash_block > 0) {
|
|
|
17c662 |
+ int max_blocks = (max_mac_data+v+hash_block-1)/hash_block;
|
|
|
17c662 |
+ int hashed_blocks = (mac_data+v+hash_block-1)/hash_block;
|
|
|
17c662 |
+ unsigned to_hash;
|
|
|
17c662 |
+
|
|
|
17c662 |
+ max_blocks -= hashed_blocks;
|
|
|
17c662 |
+ if (max_blocks < 1)
|
|
|
17c662 |
+ return;
|
|
|
17c662 |
+
|
|
|
17c662 |
+ to_hash = max_blocks * hash_block;
|
|
|
17c662 |
+ if ((unsigned)to_hash+1+tag_size < plaintext->size) {
|
|
|
17c662 |
+ _gnutls_auth_cipher_add_auth
|
|
|
17c662 |
+ (¶ms->read.cipher_state,
|
|
|
17c662 |
+ plaintext->data+plaintext->size-tag_size-to_hash-1,
|
|
|
17c662 |
+ to_hash);
|
|
|
17c662 |
}
|
|
|
17c662 |
}
|
|
|
17c662 |
}
|
|
|
17c662 |
@@ -725,8 +726,10 @@ ciphertext_to_compressed(gnutls_session_t session,
|
|
|
17c662 |
if (unlikely
|
|
|
17c662 |
(memcmp(tag, tag_ptr, tag_size) != 0 || pad_failed != 0)) {
|
|
|
17c662 |
/* HMAC was not the same. */
|
|
|
17c662 |
- dummy_wait(params, compressed, pad_failed, pad,
|
|
|
17c662 |
- length + preamble_size);
|
|
|
17c662 |
+ gnutls_datum_t data = {compressed->data, ciphertext->size};
|
|
|
17c662 |
+
|
|
|
17c662 |
+ dummy_wait(params, &data, length + preamble_size,
|
|
|
17c662 |
+ preamble_size + ciphertext->size - tag_size - 1);
|
|
|
17c662 |
|
|
|
17c662 |
return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);
|
|
|
17c662 |
}
|
|
|
17c662 |
--
|
|
|
17c662 |
2.14.3
|
|
|
17c662 |
|