From e3a7f6a48ee7aaa9b6e4a53c5ec8690cf5e9e2fb Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Wed, 8 Nov 2017 11:39:53 +0100 Subject: dtls: cookie is stored dynamically when needed rather than in pre-allocated size That reduces the number of bytes used in cases where DTLS is not in use or we are in server-side. Relates #281 Signed-off-by: Nikos Mavrogiannopoulos --- lib/gnutls_int.h | 3 +-- lib/handshake.c | 13 +++++++++---- lib/state.c | 1 + 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h index 2f7fea00d7..f5b4f673ec 100644 --- a/lib/gnutls_int.h +++ b/lib/gnutls_int.h @@ -857,8 +857,7 @@ typedef struct gnutls_dh_params_int { */ typedef struct { /* HelloVerifyRequest DOS prevention cookie */ - uint8_t cookie[DTLS_MAX_COOKIE_SIZE]; - uint8_t cookie_len; + gnutls_datum_t dcookie; /* For DTLS handshake fragmentation and reassembly. */ uint16_t hsk_write_seq; diff --git a/lib/handshake.c b/lib/handshake.c index 3746296d44..79713b65e1 100644 --- a/lib/handshake.c +++ b/lib/handshake.c @@ -1897,12 +1897,14 @@ static int send_client_hello(gnutls_session_t session, int again) /* Copy the DTLS cookie */ if (IS_DTLS(session)) { - ret = _gnutls_buffer_append_data_prefix(&extdata, 8, session->internals.dtls.cookie, - session->internals.dtls.cookie_len); + ret = _gnutls_buffer_append_data_prefix(&extdata, 8, + session->internals.dtls.dcookie.data, + session->internals.dtls.dcookie.size); if (ret < 0) { gnutls_assert(); goto cleanup; } + _gnutls_free_datum(&session->internals.dtls.dcookie); } /* Copy the ciphersuites. @@ -2090,6 +2092,7 @@ recv_hello_verify_request(gnutls_session_t session, size_t pos = 0; uint8_t cookie_len; unsigned int nb_verifs; + int ret; if (!IS_DTLS(session) || session->security_parameters.entity == GNUTLS_SERVER) { @@ -2120,8 +2123,10 @@ recv_hello_verify_request(gnutls_session_t session, DECR_LEN(len, cookie_len); - session->internals.dtls.cookie_len = cookie_len; - memcpy(session->internals.dtls.cookie, &data[pos], cookie_len); + gnutls_free(session->internals.dtls.dcookie.data); + ret = _gnutls_set_datum(&session->internals.dtls.dcookie, &data[pos], cookie_len); + if (ret < 0) + return gnutls_assert_val(ret); if (len != 0) { gnutls_assert(); diff --git a/lib/state.c b/lib/state.c index e696a05db4..a82e709d91 100644 --- a/lib/state.c +++ b/lib/state.c @@ -418,6 +418,7 @@ void gnutls_deinit(gnutls_session_t session) _mbuffer_head_clear(&session->internals.record_send_buffer); _gnutls_free_datum(&session->internals.resumption_data); + _gnutls_free_datum(&session->internals.dtls.dcookie); gnutls_free(session->internals.rexts); -- cgit v1.2.1