diff options
| author | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2019-02-25 15:11:19 +0100 |
|---|---|---|
| committer | Nikos Mavrogiannopoulos <nmav@gnutls.org> | 2019-03-02 21:15:26 +0100 |
| commit | e53bd8ed2010cc061a9d36cfc36cf8d076894ee1 (patch) | |
| tree | c7db69a59f1f656a48114497479cbea38e26b016 /lib/record.c | |
| parent | 6868c57f0879e32f1a2d9da994bdf165609afc25 (diff) | |
| download | gnutls-e53bd8ed2010cc061a9d36cfc36cf8d076894ee1.tar.gz | |
gnutls_record_send2: try to ensure integrity of operations on false and early start
This adds a double check in the sanity check of gnutls_record_send2()
for the initial_negotiation_completed value, making sure that the
check will be successful even in parallel operation of send/recv.
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
Diffstat (limited to 'lib/record.c')
| -rw-r--r-- | lib/record.c | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/lib/record.c b/lib/record.c index 272ac431b7..e7f8e4f01a 100644 --- a/lib/record.c +++ b/lib/record.c @@ -53,6 +53,7 @@ #include <dh.h> #include <random.h> #include <xsize.h> +#include "locks.h" struct tls_record_st { uint16_t header_size; @@ -1986,14 +1987,23 @@ gnutls_record_send2(gnutls_session_t session, const void *data, if (unlikely(!session->internals.initial_negotiation_completed)) { /* this is to protect buggy applications from sending unencrypted - * data. We allow sending however, if we are in false start handshake - * state. */ - if (session->internals.recv_state != RECV_STATE_FALSE_START && + * data. We allow sending however, if we are in false or early start + * handshake state. */ + gnutls_mutex_lock(&session->internals.post_negotiation_lock); + + /* we intentionally re-check the initial_negotation_completed variable + * to avoid locking during normal operation of gnutls_record_send2() */ + if (!session->internals.initial_negotiation_completed && + session->internals.recv_state != RECV_STATE_FALSE_START && session->internals.recv_state != RECV_STATE_FALSE_START_HANDLING && session->internals.recv_state != RECV_STATE_EARLY_START && session->internals.recv_state != RECV_STATE_EARLY_START_HANDLING && - !(session->internals.hsk_flags & HSK_EARLY_DATA_IN_FLIGHT)) + !(session->internals.hsk_flags & HSK_EARLY_DATA_IN_FLIGHT)) { + + gnutls_mutex_unlock(&session->internals.post_negotiation_lock); return gnutls_assert_val(GNUTLS_E_UNAVAILABLE_DURING_HANDSHAKE); + } + gnutls_mutex_unlock(&session->internals.post_negotiation_lock); } if (unlikely(!vers)) |