commit d66f070d492ef75405baad9f0d018b1bd06862c8
author Paul Bakker <p.j.bakker@polarssl.org> Thu Jan 31 16:57:45 2013 +0100
committer Paul Bakker <p.j.bakker@polarssl.org> Sat Feb 02 19:04:13 2013 +0100
tree 027422b6061ff89671d6d7ff2074fcccfff8a947
parent 4582999be608c9794d4518ae336b265084db9f93

Disable debug messages that can introduce a timing side channel.

Introduced the POLARSSL_SSL_DEBUG_ALL flag to enable all these debug
messages in case somebody does want to see the reason checks fail.

library/ssl_tls.c

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 244068a..0fae076 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -1403,9 +1403,10 @@
 
         if( ssl->in_msglen < ssl->transform_in->maclen + padlen )
         {
+#if defined(POLARSSL_SSL_DEBUG_ALL)
             SSL_DEBUG_MSG( 1, ( "msglen (%d) < maclen (%d) + padlen (%d)",
                         ssl->in_msglen, ssl->transform_in->maclen, padlen ) );
-
+#endif
             padlen = 0;
             fake_padlen = 256;
             correct = 0;
@@ -1415,9 +1416,11 @@
         {
             if( padlen > ssl->transform_in->ivlen )
             {
+#if defined(POLARSSL_SSL_DEBUG_ALL)
                 SSL_DEBUG_MSG( 1, ( "bad padding length: is %d, "
                                     "should be no more than %d",
                                padlen, ssl->transform_in->ivlen ) );
+#endif
                 correct = 0;
             }
         }
@@ -1443,8 +1446,10 @@
                 else
                     minlen = 1;
             }
+#if defined(POLARSSL_SSL_DEBUG_ALL)
             if( padlen > 0 && correct == 0)
                 SSL_DEBUG_MSG( 1, ( "bad padding byte detected" ) );
+#endif
         }
     }