<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<p class="details" style="font-style: italic; color: #666;">
<a href="https://gitlab.com/pfg666">Paul</a> created an issue: <a href="https://gitlab.com/gnutls/gnutls/-/issues/1240">#1240</a>
</p>
<div></div>
<h2 dir="auto">
<a id="user-content-description-of-problem" class="anchor" href="#description-of-problem" aria-hidden="true"></a>Description of problem:</h2>
<p dir="auto">The <a href="https://www.rfc-editor.org/rfc/rfc6347.html#page-17" rel="nofollow noreferrer noopener" target="_blank">RFC</a> states the following on computing the cookie:</p>
<blockquote dir="auto">
<p>When responding to a HelloVerifyRequest, the client MUST use the same
parameter values (version, random, session_id, cipher_suites,
compression_method) as it did in the original ClientHello. The
server SHOULD use those values to generate its cookie and verify that
they are correct upon cookie receipt.
...
Cookie = HMAC(Secret, Client-IP, Client-Parameters)</p>
</blockquote>
<p dir="auto">According to our testing, the DTLS server applications provided with GnuTLS (e.g. udp_serv.c) do not use supported cipher suites to compute a cookie from the first Client Hello received from the client. From looking at the source code of <a href="https://gitlab.com/gnutls/gnutls/-/blob/fec8a392591f0d8d048b2d60e8873535ef130279/src/udp-serv.c#L129">udp_serv.c</a>, it appears only the peer address is used, and none of the ClientHello parameters. This leads to situation where the first ClientHello can have different values for these parameters compared to the second ClientHello. For example, it allows for the interaction:</p>
<ul dir="auto">
<li>-> ClientHello(supportedCipherSuites=TLS_ECDHE...)</li>
<li><- HelloVerifyRequest</li>
<li>-> ClientHello(supportedCipherSuites=TLS_PSK...)</li>
<li><- ServerHello</li>
</ul>
<p dir="auto">This is a minor non-conformance, since cookie exchange in this form still prevents Denial of Service. The library method which generates the cookie <a href="https://gitlab.com/gnutls/gnutls/-/blob/fec8a392591f0d8d048b2d60e8873535ef130279/lib/dtls.c#L839"><code>gnutls_dtls_cookie_send</code> </a> has a <code>client_data</code> buffer parameter used to compute the cookie. Including in it ClientHello parameters would make cookie computation conform to the standard.</p>
<h2 dir="auto">
<a id="user-content-version-of-gnutls-used" class="anchor" href="#version-of-gnutls-used" aria-hidden="true"></a>Version of gnutls used:</h2>
<p dir="auto">3.7.1</p>
<h2 dir="auto">
<a id="user-content-operating-system" class="anchor" href="#operating-system" aria-hidden="true"></a>Operating System</h2>
<p dir="auto">Ubuntu 20</p>
<h2 dir="auto">
<a id="user-content-how-reproducible" class="anchor" href="#how-reproducible" aria-hidden="true"></a>How reproducible:</h2>
<p dir="auto">I attached files necessary for reproduction (see reproduction.tar.gz) using <a href="https://github.com/assist-project/dtls-fuzzer/" rel="nofollow noreferrer noopener" target="_blank">DTLS-Fuzzer</a>. Also included in the archive is a capture of the interaction similar to the one described. DTLS-Fuzzer requires the JDK for Java 8. On Ubuntu, this can be installed by running:
<code>sudo apt-get install openjdk-8-jdk</code></p>
<p dir="auto">Unpack the archive, <code>cd</code> to resulting folder and run <code>bash reproduce.sh</code>, while running an instance of Wireshark on the side. The reproduction script will:</p>
<ul dir="auto">
<li>setup DTLS-Fuzzer;</li>
<li>launch gnutls-serv utility (it is assumed the correct version of GnuTLS is already installed)</li>
<li>launch DTLS-Fuzzer to execute input sequence found in 'test_sequence', upon which DTLS-Fuzzer will send two ClientHellos with different supported cipher suites.</li>
</ul>
<h2 dir="auto">
<a id="user-content-actual-results" class="anchor" href="#actual-results" aria-hidden="true"></a>Actual results:</h2>
<p dir="auto">The server generates ServerHello, ServerHelloDone, despite having received ClientHello messages with different parameters.</p>
<h2 dir="auto">
<a id="user-content-expected-results" class="anchor" href="#expected-results" aria-hidden="true"></a>Expected results:</h2>
<p dir="auto">If the RFC had been followed, the second ClientHello should have been rejected</p>
<p dir="auto"><a href="https://gitlab.com/gnutls/gnutls/uploads/fc76c6d67fcccf4a52b88b13de13b309/reproduction.tar.gz" data-link="true" class="gfm">reproduction.tar.gz</a></p>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #666;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/issues/1240">view it on GitLab</a>.
<br>
You're receiving this email because of your account on gitlab.com.
If you'd like to receive fewer emails, you can
<a href="https://gitlab.com/-/sent_notifications/22576a11b2d1b02cc107c5040859e81b/unsubscribe">unsubscribe</a>
from this thread or
adjust your notification settings.
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/-/issues/1240"}}</script>
</p>
</div>
</body>
</html>