3 ms·

Certificate Verification Issue - GnuTLS

71 points by d0ne 13y ago

nathancahill 13y ago
@0xabad1dea's excellent sketch analysis[0] explains the root cause of the problem better than the confusing gitorious UI with the diff[1]. [0] http://imgur.com/UqAkZS7 http://imgur.com/UqAkZS7 [1] https://www.gitorious.org/gnutls/gnutls/commit/6aa26f78150ccbdf0aec1878a41c17c41d358a3b https://www.gitorious.org/gnutls/gnutls/commit/6aa26f78150cc...
- nandhp 13y ago
  I like how, as part of the fix, they've renamed the "cleanup" label to "fail".
  - sltkr 13y ago
    They haven't -- the cleanup label is still there. They added a `fail` label which explicitly sets the result variable to 0.
- valarauca1 13y ago
  One of his complaints is that they aren't using bools, when bools don't exist in c.
  - DannyBee 13y ago
    Sure they do, since c99. Section 7.16
    - valarauca1 13y ago
      I'm pretty sure that just char's and a little pre-processor hand waving.
    - LnxPrgr3 13y ago
      Even before then, C had the concept of a boolean expression, and ints were used idiomatically as bools. Unfortunately, the type system can't save you, so it's up to you to keep your promise to return the correct thing. Not even C99 can save you: $ cat booltest.c #include <stdio.h> #include <stdbool.h> bool moo() { int rv = -1; return rv; } int main(int argc, char *argv[]) { printf("moo() returned %s\n", moo() ? "TRUE" : "FALSE"); } $ clang -std=c99 -o booltest booltest.c -Wall $
      - bodyfour 13y ago
        I'm usually not much of a Java fan, but making bool a stricter type was a good change. I always write my C code as if it had the same rules. For example, if you have: bool b; int i; unsigned u; void *p; You could write code that looked like: if (b && i && u && p) ...and some people would even consider that idiomatic. I'd write the same test as: if (b && (i != 0) && (u > 0) && (p != NULL)) which is a little longer but, IMO, clearer. If the compiler enforced that style this family of bug would happen a lot less. In a similar vein, I wish enums had strict conversion rules. C++11 finally gives us that with "enum class", but I don't think anything similar exists in C.
  - fnordfnordfnord 13y ago
    s/his/her/
  - abadidea 13y ago
    If by "he" you mean the person who drew the picture: First, I absolutely LOVE it when people assume I'm a dude. Plot twist: no I don't. If you don't know someone's gender, getting it wrong with an assumption is a good way to hack them off. Second: the function is explicitly prototyped as returning bool (I highlighted this in neon green) which means caller expects true or false. It returns a negative value that is not intended to represent either true or false but a detailed error code. THAT IS THE BUG. If bools don't exist in C then neither does strlen, gahh.
coldcode 13y ago
Is this really another problem will poorly written goto's?
- nathancahill 13y ago
  No, see my link above. Goto is not the bug.
proovit 13y ago
I find the language "how to mitigate the attack" completely offensive. How about "how to verify a certificate?" Or better "how to write C code" This is a scandal. Stop.

71 points by d0ne 13y ago

@0xabad1dea's excellent sketch analysis[0] explains the root cause of the problem better than the confusing gitorious UI with the diff[1]. [0] http://imgur.com/UqAkZS7 http://imgur.com/UqAkZS7 [1] https://www.gitorious.org/gnutls/gnutls/commit/6aa26f78150ccbdf0aec1878a41c17c41d358a3b https://www.gitorious.org/gnutls/gnutls/commit/6aa26f78150cc...

nandhp 13y ago
I like how, as part of the fix, they've renamed the "cleanup" label to "fail".
- sltkr 13y ago
  They haven't -- the cleanup label is still there. They added a `fail` label which explicitly sets the result variable to 0.
valarauca1 13y ago
One of his complaints is that they aren't using bools, when bools don't exist in c.
- DannyBee 13y ago
  Sure they do, since c99. Section 7.16
  - valarauca1 13y ago
    I'm pretty sure that just char's and a little pre-processor hand waving.
  - LnxPrgr3 13y ago
    Even before then, C had the concept of a boolean expression, and ints were used idiomatically as bools. Unfortunately, the type system can't save you, so it's up to you to keep your promise to return the correct thing. Not even C99 can save you: $ cat booltest.c #include <stdio.h> #include <stdbool.h> bool moo() { int rv = -1; return rv; } int main(int argc, char *argv[]) { printf("moo() returned %s\n", moo() ? "TRUE" : "FALSE"); } $ clang -std=c99 -o booltest booltest.c -Wall $
    - bodyfour 13y ago
      I'm usually not much of a Java fan, but making bool a stricter type was a good change. I always write my C code as if it had the same rules. For example, if you have: bool b; int i; unsigned u; void *p; You could write code that looked like: if (b && i && u && p) ...and some people would even consider that idiomatic. I'd write the same test as: if (b && (i != 0) && (u > 0) && (p != NULL)) which is a little longer but, IMO, clearer. If the compiler enforced that style this family of bug would happen a lot less. In a similar vein, I wish enums had strict conversion rules. C++11 finally gives us that with "enum class", but I don't think anything similar exists in C.
- fnordfnordfnord 13y ago
  s/his/her/
- abadidea 13y ago
  If by "he" you mean the person who drew the picture: First, I absolutely LOVE it when people assume I'm a dude. Plot twist: no I don't. If you don't know someone's gender, getting it wrong with an assumption is a good way to hack them off. Second: the function is explicitly prototyped as returning bool (I highlighted this in neon green) which means caller expects true or false. It returns a negative value that is not intended to represent either true or false but a detailed error code. THAT IS THE BUG. If bools don't exist in C then neither does strlen, gahh.

coldcode 13y ago

Is this really another problem will poorly written goto's?

nathancahill 13y ago
No, see my link above. Goto is not the bug.

proovit 13y ago

I find the language "how to mitigate the attack" completely offensive. How about "how to verify a certificate?" Or better "how to write C code" This is a scandal. Stop.