[mingw-gnutls/f18] Update to 2.12.22
mooninite
mooninite at fedoraproject.org
Fri Feb 8 01:47:07 UTC 2013
commit 32d529f8f50532caea44638733951a00bb86de6b
Author: Michael Cronenworth <mike at cchtml.com>
Date: Thu Feb 7 19:46:51 2013 -0600
Update to 2.12.22
.gitignore | 1 +
gnutls-CVE-2013-1619-patch1.patch | 164 +++++++++++++++++++++++++++++++++++++
gnutls-CVE-2013-1619-patch2.patch | 98 ++++++++++++++++++++++
mingw-gnutls.spec | 15 +++-
sources | 2 +-
5 files changed, 277 insertions(+), 3 deletions(-)
---
diff --git a/.gitignore b/.gitignore
index 94afe11..4653b25 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,4 @@ gnutls-2.6.4-nosrp.tar.bz2
/gnutls-2.12.19-nosrp.tar.xz
/gnutls-2.12.20-nosrp.tar.xz
/gnutls-2.12.21-nosrp.tar.xz
+/gnutls-2.12.22-nosrp.tar.xz
diff --git a/gnutls-CVE-2013-1619-patch1.patch b/gnutls-CVE-2013-1619-patch1.patch
new file mode 100644
index 0000000..f601977
--- /dev/null
+++ b/gnutls-CVE-2013-1619-patch1.patch
@@ -0,0 +1,164 @@
+From 458c67cf98740e7b12404f6c30e0d5317d56fd30 Mon Sep 17 00:00:00 2001
+From: Nikos Mavrogiannopoulos <nmav at gnutls.org>
+Date: Mon, 4 Feb 2013 03:08:04 +0100
+Subject: [PATCH] Fixes to avoid a timing attack in TLS CBC record parsing.
+
+---
+ lib/gnutls_cipher.c | 76 ++++++++++++++++++++++++++++++------------------
+ lib/gnutls_hash_int.h | 21 +++++++++++++
+ 2 files changed, 68 insertions(+), 29 deletions(-)
+
+diff --git a/lib/gnutls_cipher.c b/lib/gnutls_cipher.c
+index 9a5d128..7ac815d 100644
+--- a/lib/gnutls_cipher.c
++++ b/lib/gnutls_cipher.c
+@@ -1,6 +1,6 @@
+ /*
+- * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2008, 2009, 2010
+- * Free Software Foundation, Inc.
++ * Copyright (C) 2000-2013 Free Software Foundation, Inc.
++ * Copyright (C) 2013 Nikos Mavrogiannopoulos
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+@@ -448,6 +448,36 @@ _gnutls_compressed2ciphertext (gnutls_session_t session,
+ return length;
+ }
+
++static void dummy_wait(record_parameters_st * params, gnutls_datum_t* plaintext,
++ unsigned pad_failed, unsigned int pad, unsigned total)
++{
++ /* this hack is only needed on CBC ciphers */
++ if (_gnutls_cipher_is_block (params->cipher_algorithm) == CIPHER_BLOCK)
++ {
++ unsigned len;
++
++ /* force an additional hash compression function evaluation to prevent timing
++ * attacks that distinguish between wrong-mac + correct pad, from wrong-mac + incorrect pad.
++ */
++ if (pad_failed == 0 && pad > 0)
++ {
++ len = _gnutls_get_hash_block_len(params->mac_algorithm);
++ if (len > 0)
++ {
++ /* This is really specific to the current hash functions.
++ * It should be removed once a protocol fix is in place.
++ */
++ if ((pad+total) % len > len-9 && total % len <= len-9)
++ {
++ if (len < plaintext->size)
++ _gnutls_auth_cipher_add_auth (¶ms->read.cipher_state, plaintext->data, len);
++ else
++ _gnutls_auth_cipher_add_auth (¶ms->read.cipher_state, plaintext->data, plaintext->size);
++ }
++ }
++ }
++ }
++}
+
+ /* Deciphers the ciphertext packet, and puts the result to compress_data, of compress_size.
+ * Returns the actual compressed packet size.
+@@ -518,23 +548,11 @@ _gnutls_ciphertext2compressed (gnutls_session_t session,
+ gnutls_assert ();
+ return GNUTLS_E_DECRYPTION_FAILED;
+ }
+- pad = ciphertext.data[ciphertext.size - 1] + 1; /* pad */
++ pad = ciphertext.data[ciphertext.size - 1]; /* pad */
+
+- if ((int) pad > (int) ciphertext.size - hash_size)
+- {
+- gnutls_assert ();
+- _gnutls_record_log
+- ("REC[%p]: Short record length %d > %d - %d (under attack?)\n",
+- session, pad, ciphertext.size, hash_size);
+- /* We do not fail here. We check below for the
+- * the pad_failed. If zero means success.
+- */
+- pad_failed = GNUTLS_E_DECRYPTION_FAILED;
+- }
+-
+- length = ciphertext.size - hash_size - pad;
+-
+- /* Check the pading bytes (TLS 1.x)
++ /* Check the pading bytes (TLS 1.x).
++ * Note that we access all 256 bytes of ciphertext for padding check
++ * because there is a timing channel in that memory access (in certain CPUs).
+ */
+ if (_gnutls_version_has_variable_padding (ver) && pad_failed == 0)
+ for (i = 2; i <= pad; i++)
+@@ -543,6 +561,11 @@ _gnutls_ciphertext2compressed (gnutls_session_t session,
+ ciphertext.data[ciphertext.size - 1])
+ pad_failed = GNUTLS_E_DECRYPTION_FAILED;
+ }
++
++ if (pad_failed)
++ pad = 0;
++ length = ciphertext.size - hash_size - pad;
++
+ break;
+ default:
+ gnutls_assert ();
+@@ -581,24 +604,19 @@ _gnutls_ciphertext2compressed (gnutls_session_t session,
+ mac_deinit (&td, MAC, ver);
+ }
+
+- /* This one was introduced to avoid a timing attack against the TLS
+- * 1.0 protocol.
+- */
+- if (pad_failed != 0)
+- {
+- gnutls_assert ();
+- return pad_failed;
+- }
+-
+ /* HMAC was not the same.
+ */
+- if (memcmp (MAC, &ciphertext.data[length], hash_size) != 0)
++ if (memcmp (MAC, &ciphertext.data[length], hash_size) != 0 || pad_failed != 0)
+ {
++ gnutls_datum_t compressed = {compress_data, compress_size};
++ /* HMAC was not the same. */
++ dummy_wait(params, &compressed, pad_failed, pad, length+preamble_size);
++
+ gnutls_assert ();
+ return GNUTLS_E_DECRYPTION_FAILED;
+ }
+
+- /* copy the decrypted stuff to compress_data.
++ /* copy the decrypted stuff to compressed_data.
+ */
+ if (compress_size < length)
+ {
+diff --git a/lib/gnutls_hash_int.h b/lib/gnutls_hash_int.h
+index ca6bba0..f4ebd03 100644
+--- a/lib/gnutls_hash_int.h
++++ b/lib/gnutls_hash_int.h
+@@ -97,4 +97,25 @@ void _gnutls_mac_deinit_ssl3_handshake (digest_hd_st * handle, void *digest,
+
+ int _gnutls_hash_copy (digest_hd_st * dst_handle, digest_hd_st * src_handle);
+
++/* We shouldn't need to know that, but a work-around in decoding
++ * TLS record padding requires that.
++ */
++inline static size_t
++_gnutls_get_hash_block_len (gnutls_digest_algorithm_t algo)
++{
++ switch (algo)
++ {
++ case GNUTLS_DIG_MD5:
++ case GNUTLS_DIG_SHA1:
++ case GNUTLS_DIG_RMD160:
++ case GNUTLS_DIG_SHA256:
++ case GNUTLS_DIG_SHA384:
++ case GNUTLS_DIG_SHA512:
++ case GNUTLS_DIG_SHA224:
++ return 64;
++ default:
++ return 0;
++ }
++}
++
+ #endif /* GNUTLS_HASH_INT_H */
+--
+1.7.1
+
diff --git a/gnutls-CVE-2013-1619-patch2.patch b/gnutls-CVE-2013-1619-patch2.patch
new file mode 100644
index 0000000..379ab61
--- /dev/null
+++ b/gnutls-CVE-2013-1619-patch2.patch
@@ -0,0 +1,98 @@
+From 93b7fcfa3297a9123630704668b2946f602b910e Mon Sep 17 00:00:00 2001
+From: Nikos Mavrogiannopoulos <nmav at gnutls.org>
+Date: Mon, 4 Feb 2013 09:39:42 +0100
+Subject: [PATCH] corrected fix
+
+---
+ lib/gnutls_cipher.c | 29 ++++++++++++++++++++---------
+ 1 files changed, 20 insertions(+), 9 deletions(-)
+
+diff --git a/lib/gnutls_cipher.c b/lib/gnutls_cipher.c
+index 7ac815d..2835121 100644
+--- a/lib/gnutls_cipher.c
++++ b/lib/gnutls_cipher.c
+@@ -449,12 +449,22 @@ _gnutls_compressed2ciphertext (gnutls_session_t session,
+ }
+
+ static void dummy_wait(record_parameters_st * params, gnutls_datum_t* plaintext,
+- unsigned pad_failed, unsigned int pad, unsigned total)
++ unsigned pad_failed, unsigned int pad, unsigned total, int ver)
+ {
+ /* this hack is only needed on CBC ciphers */
+ if (_gnutls_cipher_is_block (params->cipher_algorithm) == CIPHER_BLOCK)
+ {
++ uint8_t MAC[MAX_HASH_SIZE];
+ unsigned len;
++ digest_hd_st td;
++ int ret;
++
++ ret = mac_init (&td, params->mac_algorithm,
++ params->read.mac_secret.data,
++ params->read.mac_secret.size, ver);
++
++ if (ret < 0)
++ return;
+
+ /* force an additional hash compression function evaluation to prevent timing
+ * attacks that distinguish between wrong-mac + correct pad, from wrong-mac + incorrect pad.
+@@ -470,12 +480,14 @@ static void dummy_wait(record_parameters_st * params, gnutls_datum_t* plaintext,
+ if ((pad+total) % len > len-9 && total % len <= len-9)
+ {
+ if (len < plaintext->size)
+- _gnutls_auth_cipher_add_auth (¶ms->read.cipher_state, plaintext->data, len);
++ mac_hash (&td, plaintext->data, len, ver);
+ else
+- _gnutls_auth_cipher_add_auth (¶ms->read.cipher_state, plaintext->data, plaintext->size);
++ mac_hash (&td, plaintext->data, plaintext->size, ver);
+ }
+ }
+ }
++
++ mac_deinit (&td, MAC, ver);
+ }
+ }
+
+@@ -491,12 +503,12 @@ _gnutls_ciphertext2compressed (gnutls_session_t session,
+ {
+ uint8_t MAC[MAX_HASH_SIZE];
+ uint16_t c_length;
+- unsigned int pad;
++ unsigned int pad = 0;
+ int length;
+ uint16_t blocksize;
+ int ret, i, pad_failed = 0;
+ opaque preamble[PREAMBLE_SIZE];
+- int preamble_size;
++ int preamble_size = 0;
+ int ver = gnutls_protocol_get_version (session);
+ int hash_size = _gnutls_hash_get_algo_len (params->mac_algorithm);
+
+@@ -557,14 +569,13 @@ _gnutls_ciphertext2compressed (gnutls_session_t session,
+ if (_gnutls_version_has_variable_padding (ver) && pad_failed == 0)
+ for (i = 2; i <= pad; i++)
+ {
+- if (ciphertext.data[ciphertext.size - i] !=
+- ciphertext.data[ciphertext.size - 1])
++ if (ciphertext.data[ciphertext.size - i] != pad)
+ pad_failed = GNUTLS_E_DECRYPTION_FAILED;
+ }
+
+ if (pad_failed)
+ pad = 0;
+- length = ciphertext.size - hash_size - pad;
++ length = ciphertext.size - hash_size - pad - 1;
+
+ break;
+ default:
+@@ -610,7 +621,7 @@ _gnutls_ciphertext2compressed (gnutls_session_t session,
+ {
+ gnutls_datum_t compressed = {compress_data, compress_size};
+ /* HMAC was not the same. */
+- dummy_wait(params, &compressed, pad_failed, pad, length+preamble_size);
++ dummy_wait(params, &compressed, pad_failed, pad, length+preamble_size, ver);
+
+ gnutls_assert ();
+ return GNUTLS_E_DECRYPTION_FAILED;
+--
+1.7.1
+
diff --git a/mingw-gnutls.spec b/mingw-gnutls.spec
index 8ca7a4c..f0c4519 100644
--- a/mingw-gnutls.spec
+++ b/mingw-gnutls.spec
@@ -1,8 +1,8 @@
%?mingw_package_header
Name: mingw-gnutls
-Version: 2.12.21
-Release: 2%{?dist}
+Version: 2.12.22
+Release: 1%{?dist}
Summary: MinGW GnuTLS TLS/SSL encryption library
License: GPLv3+ and LGPLv2+
@@ -29,6 +29,10 @@ Patch6: gnutls-2.12.20-cli-debug-manpage.patch
# Use only FIPS approved ciphers in the FIPS mode
Patch7: gnutls-2.12.20-fips-algorithms.patch
+# CVE patches
+Patch900: gnutls-CVE-2013-1619-patch1.patch
+Patch901: gnutls-CVE-2013-1619-patch2.patch
+
# MinGW-specific patches.
Patch1001: gnutls-mingw-compile-fix.patch
Patch1002: gnutls-fix-external-libtasn1-detection.patch
@@ -108,6 +112,9 @@ for MinGW.
%patch6 -p1 -b .cli-debug
%patch7 -p1 -b .fips
+%patch900 -p1 -b .cve-2013-1619-1
+%patch901 -p1 -b .cve-2013-1619-2
+
%patch1001 -p0 -b .mingw_compile
%patch1002 -p0 -b .libtasn1
@@ -189,6 +196,10 @@ rm -rf $RPM_BUILD_ROOT%{mingw64_mandir}
%changelog
+* Thu Feb 07 2013 Michael Cronenworth <mike at cchtml.com> - 2.12.22-1
+- Update to 2.12.22
+- Apply patches for CVE-2013-1619
+
* Thu Nov 22 2012 Erik van Pienbroek <epienbro at fedoraproject.org> - 2.12.21-2
- Rebuild against the latest mingw-readline
diff --git a/sources b/sources
index 38e3039..55affa8 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-19b4eedf027e0313eff979e5fe391194 gnutls-2.12.21-nosrp.tar.xz
+21a57b10b4fe9cd515841974bd8c2cb7 gnutls-2.12.22-nosrp.tar.xz
More information about the scm-commits
mailing list