[SCM] GNU gnutls branch, gnutls_3_1_x, updated. gnutls_3_1_1-21-gf120c2f

[Nikos Mavrogiannopoulos]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU gnutls".

http://git.savannah.gnu.org/cgit/gnutls.git/commit/?id=f120c2fa302c40c8317a274c30bbcd98f2f62723

The branch, gnutls_3_1_x has been updated
       via  f120c2fa302c40c8317a274c30bbcd98f2f62723 (commit)
       via  a551bc7046a5269a3c569ab38452e128c00c347e (commit)
       via  8aa370b81025fac972ebdf4cbd0d56cded3892bd (commit)
      from  16809623d2e9a10097124fe1153213cd19321695 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f120c2fa302c40c8317a274c30bbcd98f2f62723
Author: Nikos Mavrogiannopoulos <address@hidden>
Date:   Sun Sep 16 11:24:01 2012 +0200

    corrected prototypes

commit a551bc7046a5269a3c569ab38452e128c00c347e
Author: Nikos Mavrogiannopoulos <address@hidden>
Date:   Sun Sep 16 11:21:45 2012 +0200

    use a %STATELESS_COMPRESSION priority string instead of gnutls_init() flag.

commit 8aa370b81025fac972ebdf4cbd0d56cded3892bd
Author: Nikos Mavrogiannopoulos <address@hidden>
Date:   Sun Sep 16 11:19:12 2012 +0200

    corrected missing parameter

-----------------------------------------------------------------------

Summary of changes:
 doc/cha-gtls-app.texi           |    5 +++++
 doc/cha-intro-tls.texi          |    2 +-
 lib/gnutls_cipher.c             |    2 +-
 lib/gnutls_int.h                |    4 ++--
 lib/gnutls_priority.c           |    4 ++++
 lib/gnutls_sig.c                |   15 +++++++--------
 lib/gnutls_state.c              |    6 +-----
 lib/includes/gnutls/gnutls.h.in |    2 --
 lib/system.h                    |    4 ++--
 9 files changed, 23 insertions(+), 21 deletions(-)

diff --git a/doc/cha-gtls-app.texi b/doc/cha-gtls-app.texi
index 7345684..7e82a42 100644
--- a/doc/cha-gtls-app.texi
+++ b/doc/cha-gtls-app.texi
@@ -979,6 +979,11 @@ will prevent the sending of any TLS extensions in client 
side. Note
 that TLS 1.2 requires extensions to be used, as well as safe
 renegotiation thus this option must be used with care.
 
address@hidden %STATELESS_COMPRESSION @tab
+will disable keeping state across records when compressing. This may
+help to mitigate attacks when compression is used but an attacker
+is in control of input data.
+
 @item %SERVER_PRECEDENCE @tab
 The ciphersuite will be selected according to server priorities
 and not the client's.
diff --git a/doc/cha-intro-tls.texi b/doc/cha-intro-tls.texi
index 8b06475..ca2a81c 100644
--- a/doc/cha-intro-tls.texi
+++ b/doc/cha-intro-tls.texi
@@ -191,7 +191,7 @@ on @xcite{RFC3749}. The supported algorithms are shown 
below.
 Note that compression enables attacks such as traffic analysis, or even
 plaintext recovery under certain circumstances. To avoid some of these
 attacks GnuTLS allows each record to be compressed independently (i.e.,
-stateless compression), by using a flag to @funcref{gnutls_init}.
+stateless compression), by using the "%STATELESS_COMPRESSION" priority string.
 
 @node Weaknesses and countermeasures
 @subsection Weaknesses and countermeasures
diff --git a/lib/gnutls_cipher.c b/lib/gnutls_cipher.c
index 5266fbe..248b376 100644
--- a/lib/gnutls_cipher.c
+++ b/lib/gnutls_cipher.c
@@ -105,7 +105,7 @@ _gnutls_encrypt (gnutls_session_t session, const uint8_t * 
headers,
         return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
       
       ret = _gnutls_compress(&params->write.compression_state, data, 
data_size, 
-                             comp.data, comp.size, 
session->internals.stateless_compression);
+                             comp.data, comp.size, 
session->internals.priorities.stateless_compression);
       if (ret < 0)
         {
           gnutls_free(comp.data);
diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index a120426..8c0399e 100644
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -587,6 +587,8 @@ struct gnutls_priority_st
   unsigned int ssl3_record_version:1;
   unsigned int server_precedence:1;
   unsigned int allow_key_usage_violation:1;
+  /* Whether stateless compression will be used */
+  unsigned int stateless_compression:1;
   unsigned int additional_verify_flags;
 };
 
@@ -877,8 +879,6 @@ typedef struct
   /* if set it means that the master key was set using
    * gnutls_session_set_master() rather than being negotiated. */
   unsigned int premaster_set:1;
-  /* Whether stateless compression will be used */
-  unsigned int stateless_compression:1;
 
   unsigned int cb_tls_unique_len;
   unsigned char cb_tls_unique[MAX_VERIFY_DATA_SIZE];
diff --git a/lib/gnutls_priority.c b/lib/gnutls_priority.c
index decd6d5..c5db0a2 100644
--- a/lib/gnutls_priority.c
+++ b/lib/gnutls_priority.c
@@ -986,6 +986,10 @@ gnutls_priority_init (gnutls_priority_t * priority_cache,
             {
               (*priority_cache)->no_extensions = 1;
             }
+          else if (strcasecmp (&broken_list[i][1], "STATELESS_COMPRESSION") == 
0)
+            {
+              (*priority_cache)->stateless_compression = 1;
+            }
           else if (strcasecmp (&broken_list[i][1],
                                "VERIFY_ALLOW_SIGN_RSA_MD5") == 0)
             {
diff --git a/lib/gnutls_sig.c b/lib/gnutls_sig.c
index 4ba1527..c3665c6 100644
--- a/lib/gnutls_sig.c
+++ b/lib/gnutls_sig.c
@@ -235,7 +235,8 @@ es_cleanup:
 }
 
 static int
-verify_tls_hash (gnutls_protocol_t ver, gnutls_pcert_st* cert,
+verify_tls_hash (gnutls_session_t session,
+                 gnutls_protocol_t ver, gnutls_pcert_st* cert,
                  const gnutls_datum_t * hash_concat,
                  gnutls_datum_t * signature, size_t sha1pos,
                  gnutls_sign_algorithm_t sign_algo,
@@ -384,11 +385,9 @@ _gnutls_handshake_verify_data (gnutls_session_t session, 
gnutls_pcert_st* cert,
       dconcat.size = _gnutls_hash_get_algo_len (hash_algo);
     }
 
-  ret = verify_tls_hash (ver, cert, &dconcat, signature,
-                            dconcat.size -
-                            _gnutls_hash_get_algo_len (hash_algo),
-                            sign_algo,
-                            gnutls_sign_get_pk_algorithm (sign_algo));
+  ret = verify_tls_hash (session, ver, cert, &dconcat, signature,
+                            dconcat.size - _gnutls_hash_get_algo_len 
(hash_algo),
+                            sign_algo, gnutls_sign_get_pk_algorithm 
(sign_algo));
   if (ret < 0)
     {
       gnutls_assert ();
@@ -433,7 +432,7 @@ _gnutls_handshake_verify_crt_vrfy12 (gnutls_session_t 
session,
   dconcat.size = _gnutls_hash_get_algo_len (hash_algo);
 
   ret =
-    verify_tls_hash (ver, cert, &dconcat, signature, 0, sign_algo, pk);
+    verify_tls_hash (session, ver, cert, &dconcat, signature, 0, sign_algo, 
pk);
   if (ret < 0)
     {
       gnutls_assert ();
@@ -527,7 +526,7 @@ _gnutls_handshake_verify_crt_vrfy (gnutls_session_t session,
   dconcat.size = 20 + 16;       /* md5+ sha */
 
   ret =
-    verify_tls_hash (ver, cert, &dconcat, signature, 16,
+    verify_tls_hash (session, ver, cert, &dconcat, signature, 16,
                      GNUTLS_SIGN_UNKNOWN,
                      gnutls_pubkey_get_pk_algorithm(cert->pubkey, NULL));
   if (ret < 0)
diff --git a/lib/gnutls_state.c b/lib/gnutls_state.c
index b9354aa..fee5afa 100644
--- a/lib/gnutls_state.c
+++ b/lib/gnutls_state.c
@@ -293,8 +293,7 @@ _gnutls_handshake_internal_state_clear (gnutls_session_t 
session)
  * @flags can be one of %GNUTLS_CLIENT and %GNUTLS_SERVER. For a DTLS
  * entity, the flags %GNUTLS_DATAGRAM and  %GNUTLS_NONBLOCK are
  * also available. The latter flag will enable a non-blocking
- * operation of the DTLS timers. The flag %GNUTLS_STATELESS_COMPRESSION
- * would disable keeping state across records when compressing.
+ * operation of the DTLS timers. 
  *
  * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
  **/
@@ -393,9 +392,6 @@ gnutls_init (gnutls_session_t * session, unsigned int flags)
   else
     (*session)->internals.transport = GNUTLS_STREAM;
   
-  if (flags & GNUTLS_STATELESS_COMPRESSION)
-    (*session)->internals.stateless_compression = 1;
-  
   if (flags & GNUTLS_NONBLOCK)
     (*session)->internals.dtls.blocking = 0;
   else
diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in
index 51d853e..5b6651a 100644
--- a/lib/includes/gnutls/gnutls.h.in
+++ b/lib/includes/gnutls/gnutls.h.in
@@ -295,14 +295,12 @@ extern "C"
    * @GNUTLS_CLIENT: Connection end is a client.
    * @GNUTLS_DATAGRAM: Connection is datagram oriented (DTLS).
    * @GNUTLS_NONBLOCK: Connection should not block (DTLS).
-   * @GNUTLS_STATELESS_COMPRESSION: Compression will be applied independently 
on each record.
    *
    */
 #define GNUTLS_SERVER 1
 #define GNUTLS_CLIENT (1<<1)
 #define GNUTLS_DATAGRAM (1<<2)
 #define GNUTLS_NONBLOCK (1<<3)
-#define GNUTLS_STATELESS_COMPRESSION (1<<4)
 
 /**
  * gnutls_alert_level_t:
diff --git a/lib/system.h b/lib/system.h
index 0afbdd2..2902695 100644
--- a/lib/system.h
+++ b/lib/system.h
@@ -71,7 +71,7 @@ struct timespec ts;
 
 int _gnutls_find_config_path(char* path, size_t max_size);
 
-int gnutls_system_global_init ();
-void gnutls_system_global_deinit ();
+int gnutls_system_global_init (void);
+void gnutls_system_global_deinit (void);
 
 #endif /* SYSTEM_H */


hooks/post-receive
-- 
GNU gnutls