[Help-gnutls] Problem with anonymous authentication

[Alexei Boyarchenko]

> This shouldn't have happened. Could you trace where this happens?

Sorry for my bad English again!!!!

I think i've found a bug! (maybe i am right maybe not :) )
Version: gnutls-1.0.9


Look!

if after initialisation we have:

&anon_serv_cred = 0x0053a754  
and at that adress  we have 0x00935610 -- adress of anon_serv_cred
    
anon_serv_cred  = 0x00935610  
and at that adress  we have 0x00935420 -- adress of global_dh_params
                            0x00000000 -- NULL !!!!!!!!!!

global_dh_params       = 0x00935420
and at that adress  we have 0x00935420 -- not NULL! adress of 
global_dh_params->params[0]  
                            0x00952620 -- not NULL! adress of 
global_dh_params->params[1]


when we call function check_server_params in gnutls_handshake.c

.......
 else if ( cred_type == GNUTLS_CRD_ANON) {
		anon_cred =                               
		    _gnutls_get_cred(session->key, cred_type, NULL); //!!!!!
	
		if (anon_cred != NULL) {
			dh_params = anon_cred->dh_params; //!!
		}
	} else return 0; /* no need for params */


	/* If the key exchange method needs RSA or DH params,
	 * but they are not set then remove it.
	 */
	if (_gnutls_kx_needs_rsa_params( kx) != 0) {
		/* needs rsa params. */
		if (_gnutls_get_rsa_params( rsa_params)==NULL)
			return 1;
	}
	
	if (_gnutls_kx_needs_dh_params( kx) != 0) {
		/* needs DH params. */
		if (_gnutls_get_dh_params( dh_params)==NULL)
			return 1;
	}
.....
we get anon_cred = &anon_serv_cred = 0x0053a754 
and at that adress we have 0x00935610 adress of anon_serv_cred (but not 
global_dh_params!!!)
so when we do 	
		if (anon_cred != NULL) {
			dh_params = anon_cred->dh_params; //!!
		}
dh_params = 0x00935610  but this is adress of anon_serv_cred  and not adress
of global_dh_params !!!!

And we get dh_params = anon_serv_cred  = 0x00935610
at that adress we have   0x00935420 -- adress of global_dh_params
                         0x00000000 --  NULL !!!!!!!!!!

So we get _gnutls_get_dh_params( dh_params)==NULL   !!!!!!!!!



I changed this code in this way:

void** MyTmp;
.....
 else if ( cred_type == GNUTLS_CRD_ANON) {
		MyTmp =
		    _gnutls_get_cred(session->key, cred_type, NULL);
	
		if (MyTmp != NULL) {
			anon_cred =  *MyTmp;
			dh_params = anon_cred->dh_params;
		}
	} else return 0; /* no need for params */


	/* If the key exchange method needs RSA or DH params,
	 * but they are not set then remove it.
	 */
	if (_gnutls_kx_needs_rsa_params( kx) != 0) {
		/* needs rsa params. */
		if (_gnutls_get_rsa_params( rsa_params)==NULL)
			return 1;
	}
	
	if (_gnutls_kx_needs_dh_params( kx) != 0) {
		/* needs DH params. */
		if (_gnutls_get_dh_params( dh_params)==NULL)
			return 1;
	}
......

and it works fine!!!

Also i had to correct function gen_anon_server_kx in anon_auth.c :
....
	gnutls_dh_params dh_params;
	const gnutls_anon_server_credentials cred;
	void** MyTmp;
	
	MyTmp = _gnutls_get_cred(session->key, GNUTLS_CRD_ANON, NULL);
	if (MyTmp == NULL) {
		gnutls_assert();
		return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
	}

	cred = *MyTmp;
	dh_params = _gnutls_anon_get_dh_params( cred, session);
....

And eventually I recieved completely   working server with anonymous 
authentication.