mirror of
https://abf.rosa.ru/djam/openssl.git
synced 2025-02-23 16:22:50 +00:00
68 lines
1.7 KiB
Diff
68 lines
1.7 KiB
Diff
|
|
http://cvs.openssl.org/chngview?cn=21931
|
|
|
|
--- ssl/d1_pkt.c 2011-01-04 19:33:22.000000000 +0000
|
|
+++ ssl/d1_pkt.c.oden 2012-01-09 15:18:39.000000000 +0000
|
|
@@ -375,6 +375,7 @@ dtls1_process_record(SSL *s)
|
|
SSL3_RECORD *rr;
|
|
unsigned int mac_size;
|
|
unsigned char md[EVP_MAX_MD_SIZE];
|
|
+ int decryption_failed_or_bad_record_mac = 0;
|
|
|
|
|
|
rr= &(s->s3->rrec);
|
|
@@ -409,13 +410,10 @@ dtls1_process_record(SSL *s)
|
|
enc_err = s->method->ssl3_enc->enc(s,0);
|
|
if (enc_err <= 0)
|
|
{
|
|
- if (enc_err == 0)
|
|
- /* SSLerr() and ssl3_send_alert() have been called */
|
|
- goto err;
|
|
-
|
|
- /* otherwise enc_err == -1 */
|
|
- al=SSL_AD_BAD_RECORD_MAC;
|
|
- goto f_err;
|
|
+ /* To minimize information leaked via timing, we will always
|
|
+ * perform all computations before discarding the message.
|
|
+ */
|
|
+ decryption_failed_or_bad_record_mac = 1;
|
|
}
|
|
|
|
#ifdef TLS_DEBUG
|
|
@@ -445,7 +443,7 @@ printf("\n");
|
|
SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);
|
|
goto f_err;
|
|
#else
|
|
- goto err;
|
|
+ decryption_failed_or_bad_record_mac = 1;
|
|
#endif
|
|
}
|
|
/* check the MAC for rr->input (it's in mac_size bytes at the tail) */
|
|
@@ -456,17 +454,25 @@ printf("\n");
|
|
SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_LENGTH_TOO_SHORT);
|
|
goto f_err;
|
|
#else
|
|
- goto err;
|
|
+ decryption_failed_or_bad_record_mac = 1;
|
|
#endif
|
|
}
|
|
rr->length-=mac_size;
|
|
i=s->method->ssl3_enc->mac(s,md,0);
|
|
if (i < 0 || memcmp(md,&(rr->data[rr->length]),mac_size) != 0)
|
|
{
|
|
- goto err;
|
|
+ decryption_failed_or_bad_record_mac = 1;
|
|
}
|
|
}
|
|
|
|
+ if (decryption_failed_or_bad_record_mac)
|
|
+ {
|
|
+ /* decryption failed, silently discard message */
|
|
+ rr->length = 0;
|
|
+ s->packet_length = 0;
|
|
+ goto err;
|
|
+ }
|
|
+
|
|
/* r->length is now just compressed */
|
|
if (s->expand != NULL)
|
|
{
|