2 * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include "../ssl_locl.h"
11 #include "internal/constant_time_locl.h"
12 #include <openssl/rand.h>
13 #include "record_locl.h"
14 #include "internal/cryptlib.h"
16 static const unsigned char ssl3_pad_1[48] = {
17 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
18 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
19 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
20 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
21 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
22 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36
25 static const unsigned char ssl3_pad_2[48] = {
26 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
27 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
28 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
29 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
30 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
31 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c
35 * Clear the contents of an SSL3_RECORD but retain any memory allocated
37 void SSL3_RECORD_clear(SSL3_RECORD *r, size_t num_recs)
42 for (i = 0; i < num_recs; i++) {
45 memset(&r[i], 0, sizeof(*r));
50 void SSL3_RECORD_release(SSL3_RECORD *r, size_t num_recs)
54 for (i = 0; i < num_recs; i++) {
55 OPENSSL_free(r[i].comp);
60 void SSL3_RECORD_set_seq_num(SSL3_RECORD *r, const unsigned char *seq_num)
62 memcpy(r->seq_num, seq_num, SEQ_NUM_SIZE);
66 * Peeks ahead into "read_ahead" data to see if we have a whole record waiting
67 * for us in the buffer.
69 static int ssl3_record_app_data_waiting(SSL *s)
75 rbuf = RECORD_LAYER_get_rbuf(&s->rlayer);
77 p = SSL3_BUFFER_get_buf(rbuf);
81 left = SSL3_BUFFER_get_left(rbuf);
83 if (left < SSL3_RT_HEADER_LENGTH)
86 p += SSL3_BUFFER_get_offset(rbuf);
89 * We only check the type and record length, we will sanity check version
92 if (*p != SSL3_RT_APPLICATION_DATA)
98 if (left < SSL3_RT_HEADER_LENGTH + len)
104 int early_data_count_ok(SSL *s, size_t length, size_t overhead, int *al)
106 uint32_t max_early_data = s->max_early_data;
107 SSL_SESSION *sess = s->session;
110 * If we are a client then we always use the max_early_data from the
111 * session/psksession. Otherwise we go with the lowest out of the max early
112 * data set in the session and the configured max_early_data.
114 if (!s->server && sess->ext.max_early_data == 0) {
115 if (!ossl_assert(s->psksession != NULL
116 && s->psksession->ext.max_early_data > 0)) {
117 SSLerr(SSL_F_EARLY_DATA_COUNT_OK, ERR_R_INTERNAL_ERROR);
120 sess = s->psksession;
123 || (s->hit && sess->ext.max_early_data < s->max_early_data))
124 max_early_data = sess->ext.max_early_data;
126 if (max_early_data == 0) {
128 *al = SSL_AD_UNEXPECTED_MESSAGE;
129 SSLerr(SSL_F_EARLY_DATA_COUNT_OK, SSL_R_TOO_MUCH_EARLY_DATA);
133 /* If we are dealing with ciphertext we need to allow for the overhead */
134 max_early_data += overhead;
136 if (s->early_data_count + length > max_early_data) {
138 *al = SSL_AD_UNEXPECTED_MESSAGE;
139 SSLerr(SSL_F_EARLY_DATA_COUNT_OK, SSL_R_TOO_MUCH_EARLY_DATA);
142 s->early_data_count += length;
148 * MAX_EMPTY_RECORDS defines the number of consecutive, empty records that
149 * will be processed per call to ssl3_get_record. Without this limit an
150 * attacker could send empty records at a faster rate than we can process and
151 * cause ssl3_get_record to loop forever.
153 #define MAX_EMPTY_RECORDS 32
155 #define SSL2_RT_HEADER_LENGTH 2
157 * Call this to get new input records.
158 * It will return <= 0 if more data is needed, normally due to an error
159 * or non-blocking IO.
160 * When it finishes, |numrpipes| records have been decoded. For each record 'i':
161 * rr[i].type - is the type of record
163 * rr[i].length, - number of bytes
164 * Multiple records will only be returned if the record types are all
165 * SSL3_RT_APPLICATION_DATA. The number of records returned will always be <=
168 /* used only by ssl3_read_bytes */
169 int ssl3_get_record(SSL *s)
172 int enc_err, rret, ret = -1;
175 SSL3_RECORD *rr, *thisrr;
179 unsigned char md[EVP_MAX_MD_SIZE];
180 unsigned int version;
183 size_t num_recs = 0, max_recs, j;
184 PACKET pkt, sslv2pkt;
185 size_t first_rec_len;
187 rr = RECORD_LAYER_get_rrec(&s->rlayer);
188 rbuf = RECORD_LAYER_get_rbuf(&s->rlayer);
189 max_recs = s->max_pipelines;
195 thisrr = &rr[num_recs];
197 /* check if we have the header */
198 if ((RECORD_LAYER_get_rstate(&s->rlayer) != SSL_ST_READ_BODY) ||
199 (RECORD_LAYER_get_packet_length(&s->rlayer)
200 < SSL3_RT_HEADER_LENGTH)) {
204 rret = ssl3_read_n(s, SSL3_RT_HEADER_LENGTH,
205 SSL3_BUFFER_get_len(rbuf), 0,
206 num_recs == 0 ? 1 : 0, &n);
208 return rret; /* error or non-blocking */
209 RECORD_LAYER_set_rstate(&s->rlayer, SSL_ST_READ_BODY);
211 p = RECORD_LAYER_get_packet(&s->rlayer);
212 if (!PACKET_buf_init(&pkt, RECORD_LAYER_get_packet(&s->rlayer),
213 RECORD_LAYER_get_packet_length(&s->rlayer))) {
214 al = SSL_AD_INTERNAL_ERROR;
215 SSLerr(SSL_F_SSL3_GET_RECORD, ERR_R_INTERNAL_ERROR);
219 if (!PACKET_get_net_2_len(&sslv2pkt, &sslv2len)
220 || !PACKET_get_1(&sslv2pkt, &type)) {
221 al = SSL_AD_DECODE_ERROR;
222 SSLerr(SSL_F_SSL3_GET_RECORD, ERR_R_INTERNAL_ERROR);
226 * The first record received by the server may be a V2ClientHello.
228 if (s->server && RECORD_LAYER_is_first_record(&s->rlayer)
229 && (sslv2len & 0x8000) != 0
230 && (type == SSL2_MT_CLIENT_HELLO)) {
234 * |num_recs| here will actually always be 0 because
235 * |num_recs > 0| only ever occurs when we are processing
236 * multiple app data records - which we know isn't the case here
237 * because it is an SSLv2ClientHello. We keep it using
238 * |num_recs| for the sake of consistency
240 thisrr->type = SSL3_RT_HANDSHAKE;
241 thisrr->rec_version = SSL2_VERSION;
243 thisrr->length = sslv2len & 0x7fff;
245 if (thisrr->length > SSL3_BUFFER_get_len(rbuf)
246 - SSL2_RT_HEADER_LENGTH) {
247 al = SSL_AD_RECORD_OVERFLOW;
248 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_PACKET_LENGTH_TOO_LONG);
252 if (thisrr->length < MIN_SSL2_RECORD_LEN) {
253 al = SSL_AD_DECODE_ERROR;
254 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_LENGTH_TOO_SHORT);
258 /* SSLv3+ style record */
260 s->msg_callback(0, 0, SSL3_RT_HEADER, p, 5, s,
261 s->msg_callback_arg);
263 /* Pull apart the header into the SSL3_RECORD */
264 if (!PACKET_get_1(&pkt, &type)
265 || !PACKET_get_net_2(&pkt, &version)
266 || !PACKET_get_net_2_len(&pkt, &thisrr->length)) {
267 al = SSL_AD_DECODE_ERROR;
268 SSLerr(SSL_F_SSL3_GET_RECORD, ERR_R_INTERNAL_ERROR);
272 thisrr->rec_version = version;
275 * Lets check version. In TLSv1.3 we ignore this field. For an
276 * HRR we haven't actually selected TLSv1.3 yet, but we still
277 * treat it as TLSv1.3, so we must check for that explicitly
279 if (!s->first_packet && !SSL_IS_TLS13(s)
280 && !s->hello_retry_request
281 && version != (unsigned int)s->version) {
282 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_WRONG_VERSION_NUMBER);
283 if ((s->version & 0xFF00) == (version & 0xFF00)
284 && !s->enc_write_ctx && !s->write_hash) {
285 if (thisrr->type == SSL3_RT_ALERT) {
287 * The record is using an incorrect version number,
288 * but what we've got appears to be an alert. We
289 * haven't read the body yet to check whether its a
290 * fatal or not - but chances are it is. We probably
291 * shouldn't send a fatal alert back. We'll just
297 * Send back error using their minor version number :-)
299 s->version = (unsigned short)version;
301 al = SSL_AD_PROTOCOL_VERSION;
305 if ((version >> 8) != SSL3_VERSION_MAJOR) {
306 if (RECORD_LAYER_is_first_record(&s->rlayer)) {
307 /* Go back to start of packet, look at the five bytes
309 p = RECORD_LAYER_get_packet(&s->rlayer);
310 if (strncmp((char *)p, "GET ", 4) == 0 ||
311 strncmp((char *)p, "POST ", 5) == 0 ||
312 strncmp((char *)p, "HEAD ", 5) == 0 ||
313 strncmp((char *)p, "PUT ", 4) == 0) {
314 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_HTTP_REQUEST);
316 } else if (strncmp((char *)p, "CONNE", 5) == 0) {
317 SSLerr(SSL_F_SSL3_GET_RECORD,
318 SSL_R_HTTPS_PROXY_REQUEST);
322 /* Doesn't look like TLS - don't send an alert */
323 SSLerr(SSL_F_SSL3_GET_RECORD,
324 SSL_R_WRONG_VERSION_NUMBER);
327 SSLerr(SSL_F_SSL3_GET_RECORD,
328 SSL_R_WRONG_VERSION_NUMBER);
329 al = SSL_AD_PROTOCOL_VERSION;
334 if (SSL_IS_TLS13(s) && s->enc_read_ctx != NULL
335 && thisrr->type != SSL3_RT_APPLICATION_DATA) {
336 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BAD_RECORD_TYPE);
337 al = SSL_AD_UNEXPECTED_MESSAGE;
342 SSL3_BUFFER_get_len(rbuf) - SSL3_RT_HEADER_LENGTH) {
343 al = SSL_AD_RECORD_OVERFLOW;
344 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_PACKET_LENGTH_TOO_LONG);
349 /* now s->rlayer.rstate == SSL_ST_READ_BODY */
352 if (SSL_IS_TLS13(s)) {
353 if (thisrr->length > SSL3_RT_MAX_TLS13_ENCRYPTED_LENGTH) {
354 al = SSL_AD_RECORD_OVERFLOW;
355 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
359 size_t len = SSL3_RT_MAX_ENCRYPTED_LENGTH;
361 #ifndef OPENSSL_NO_COMP
363 * If OPENSSL_NO_COMP is defined then SSL3_RT_MAX_ENCRYPTED_LENGTH
364 * does not include the compression overhead anyway.
366 if (s->expand == NULL)
367 len -= SSL3_RT_MAX_COMPRESSED_OVERHEAD;
370 if (thisrr->length > len) {
371 al = SSL_AD_RECORD_OVERFLOW;
372 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
378 * s->rlayer.rstate == SSL_ST_READ_BODY, get and decode the data.
379 * Calculate how much more data we need to read for the rest of the
382 if (thisrr->rec_version == SSL2_VERSION) {
383 more = thisrr->length + SSL2_RT_HEADER_LENGTH
384 - SSL3_RT_HEADER_LENGTH;
386 more = thisrr->length;
389 /* now s->packet_length == SSL3_RT_HEADER_LENGTH */
391 rret = ssl3_read_n(s, more, more, 1, 0, &n);
393 return rret; /* error or non-blocking io */
396 /* set state for later operations */
397 RECORD_LAYER_set_rstate(&s->rlayer, SSL_ST_READ_HEADER);
400 * At this point, s->packet_length == SSL3_RT_HEADER_LENGTH
401 * + thisrr->length, or s->packet_length == SSL2_RT_HEADER_LENGTH
402 * + thisrr->length and we have that many bytes in s->packet
404 if (thisrr->rec_version == SSL2_VERSION) {
406 &(RECORD_LAYER_get_packet(&s->rlayer)[SSL2_RT_HEADER_LENGTH]);
409 &(RECORD_LAYER_get_packet(&s->rlayer)[SSL3_RT_HEADER_LENGTH]);
413 * ok, we can now read from 's->packet' data into 'thisrr' thisrr->input
414 * points at thisrr->length bytes, which need to be copied into
415 * thisrr->data by either the decryption or by the decompression When
416 * the data is 'copied' into the thisrr->data buffer, thisrr->input will
417 * be pointed at the new buffer
421 * We now have - encrypted [ MAC [ compressed [ plain ] ] ]
422 * thisrr->length bytes of encrypted compressed stuff.
425 /* decrypt in place in 'thisrr->input' */
426 thisrr->data = thisrr->input;
427 thisrr->orig_len = thisrr->length;
429 /* Mark this record as not read by upper layers yet */
434 /* we have pulled in a full packet so zero things */
435 RECORD_LAYER_reset_packet_length(&s->rlayer);
436 RECORD_LAYER_clear_first_record(&s->rlayer);
437 } while (num_recs < max_recs
438 && thisrr->type == SSL3_RT_APPLICATION_DATA
439 && SSL_USE_EXPLICIT_IV(s)
440 && s->enc_read_ctx != NULL
441 && (EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(s->enc_read_ctx))
442 & EVP_CIPH_FLAG_PIPELINE)
443 && ssl3_record_app_data_waiting(s));
446 * If in encrypt-then-mac mode calculate mac from encrypted record. All
447 * the details below are public so no timing details can leak.
449 if (SSL_READ_ETM(s) && s->read_hash) {
451 /* TODO(size_t): convert this to do size_t properly */
452 imac_size = EVP_MD_CTX_size(s->read_hash);
453 if (!ossl_assert(imac_size >= 0 && imac_size <= EVP_MAX_MD_SIZE)) {
454 al = SSL_AD_INTERNAL_ERROR;
455 SSLerr(SSL_F_SSL3_GET_RECORD, ERR_LIB_EVP);
458 mac_size = (size_t)imac_size;
459 for (j = 0; j < num_recs; j++) {
462 if (thisrr->length < mac_size) {
463 al = SSL_AD_DECODE_ERROR;
464 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_LENGTH_TOO_SHORT);
467 thisrr->length -= mac_size;
468 mac = thisrr->data + thisrr->length;
469 i = s->method->ssl3_enc->mac(s, thisrr, md, 0 /* not send */ );
470 if (i == 0 || CRYPTO_memcmp(md, mac, mac_size) != 0) {
471 al = SSL_AD_BAD_RECORD_MAC;
472 SSLerr(SSL_F_SSL3_GET_RECORD,
473 SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
479 first_rec_len = rr[0].length;
481 enc_err = s->method->ssl3_enc->enc(s, rr, num_recs, 0);
485 * 0: (in non-constant time) if the record is publicly invalid.
486 * 1: if the padding is valid
487 * -1: if the padding is invalid
490 if (num_recs == 1 && ossl_statem_skip_early_data(s)) {
492 * Valid early_data that we cannot decrypt might fail here as
493 * publicly invalid. We treat it like an empty record.
498 if (!early_data_count_ok(s, thisrr->length,
499 EARLY_DATA_CIPHERTEXT_OVERHEAD, &al))
504 RECORD_LAYER_set_numrpipes(&s->rlayer, 1);
505 RECORD_LAYER_reset_read_sequence(&s->rlayer);
508 al = SSL_AD_DECRYPTION_FAILED;
509 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
513 printf("dec %"OSSLzu"\n", rr[0].length);
516 for (z = 0; z < rr[0].length; z++)
517 printf("%02X%c", rr[0].data[z], ((z + 1) % 16) ? ' ' : '\n');
522 /* r->length is now the compressed data plus mac */
523 if ((sess != NULL) &&
524 (s->enc_read_ctx != NULL) &&
525 (!SSL_READ_ETM(s) && EVP_MD_CTX_md(s->read_hash) != NULL)) {
526 /* s->read_hash != NULL => mac_size != -1 */
527 unsigned char *mac = NULL;
528 unsigned char mac_tmp[EVP_MAX_MD_SIZE];
530 mac_size = EVP_MD_CTX_size(s->read_hash);
531 if (!ossl_assert(mac_size <= EVP_MAX_MD_SIZE)) {
532 al = SSL_AD_INTERNAL_ERROR;
533 SSLerr(SSL_F_SSL3_GET_RECORD, ERR_R_INTERNAL_ERROR);
537 for (j = 0; j < num_recs; j++) {
540 * orig_len is the length of the record before any padding was
541 * removed. This is public information, as is the MAC in use,
542 * therefore we can safely process the record in a different amount
543 * of time if it's too short to possibly contain a MAC.
545 if (thisrr->orig_len < mac_size ||
546 /* CBC records must have a padding length byte too. */
547 (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
548 thisrr->orig_len < mac_size + 1)) {
549 al = SSL_AD_DECODE_ERROR;
550 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_LENGTH_TOO_SHORT);
554 if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE) {
556 * We update the length so that the TLS header bytes can be
557 * constructed correctly but we need to extract the MAC in
558 * constant time from within the record, without leaking the
559 * contents of the padding bytes.
562 if (!ssl3_cbc_copy_mac(mac_tmp, thisrr, mac_size)) {
563 al = SSL_AD_INTERNAL_ERROR;
564 SSLerr(SSL_F_SSL3_GET_RECORD, ERR_R_INTERNAL_ERROR);
567 thisrr->length -= mac_size;
570 * In this case there's no padding, so |rec->orig_len| equals
571 * |rec->length| and we checked that there's enough bytes for
574 thisrr->length -= mac_size;
575 mac = &thisrr->data[thisrr->length];
578 i = s->method->ssl3_enc->mac(s, thisrr, md, 0 /* not send */ );
579 if (i == 0 || mac == NULL
580 || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0)
582 if (thisrr->length > SSL3_RT_MAX_COMPRESSED_LENGTH + mac_size)
588 if (num_recs == 1 && ossl_statem_skip_early_data(s)) {
590 * We assume this is unreadable early_data - we treat it like an
595 * The record length may have been modified by the mac check above
596 * so we use the previously saved value
598 if (!early_data_count_ok(s, first_rec_len,
599 EARLY_DATA_CIPHERTEXT_OVERHEAD, &al))
605 RECORD_LAYER_set_numrpipes(&s->rlayer, 1);
606 RECORD_LAYER_reset_read_sequence(&s->rlayer);
610 * A separate 'decryption_failed' alert was introduced with TLS 1.0,
611 * SSL 3.0 only has 'bad_record_mac'. But unless a decryption
612 * failure is directly visible from the ciphertext anyway, we should
613 * not reveal which kind of error occurred -- this might become
614 * visible to an attacker (e.g. via a logfile)
616 al = SSL_AD_BAD_RECORD_MAC;
617 SSLerr(SSL_F_SSL3_GET_RECORD,
618 SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
622 for (j = 0; j < num_recs; j++) {
625 /* thisrr->length is now just compressed */
626 if (s->expand != NULL) {
627 if (thisrr->length > SSL3_RT_MAX_COMPRESSED_LENGTH) {
628 al = SSL_AD_RECORD_OVERFLOW;
629 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_COMPRESSED_LENGTH_TOO_LONG);
632 if (!ssl3_do_uncompress(s, thisrr)) {
633 al = SSL_AD_DECOMPRESSION_FAILURE;
634 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BAD_DECOMPRESSION);
639 if (SSL_IS_TLS13(s) && s->enc_read_ctx != NULL) {
642 if (thisrr->length == 0
643 || thisrr->type != SSL3_RT_APPLICATION_DATA) {
644 al = SSL_AD_UNEXPECTED_MESSAGE;
645 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BAD_RECORD_TYPE);
649 /* Strip trailing padding */
650 for (end = thisrr->length - 1; end > 0 && thisrr->data[end] == 0;
654 thisrr->length = end;
655 thisrr->type = thisrr->data[end];
656 if (thisrr->type != SSL3_RT_APPLICATION_DATA
657 && thisrr->type != SSL3_RT_ALERT
658 && thisrr->type != SSL3_RT_HANDSHAKE) {
659 al = SSL_AD_UNEXPECTED_MESSAGE;
660 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BAD_RECORD_TYPE);
664 s->msg_callback(0, s->version, SSL3_RT_INNER_CONTENT_TYPE,
665 &thisrr->data[end], 1, s, s->msg_callback_arg);
669 * TLSv1.3 alert and handshake records are required to be non-zero in
673 && (thisrr->type == SSL3_RT_HANDSHAKE
674 || thisrr->type == SSL3_RT_ALERT)
675 && thisrr->length == 0) {
676 al = SSL_AD_UNEXPECTED_MESSAGE;
677 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BAD_LENGTH);
681 if (thisrr->length > SSL3_RT_MAX_PLAIN_LENGTH) {
682 al = SSL_AD_RECORD_OVERFLOW;
683 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_DATA_LENGTH_TOO_LONG);
689 * So at this point the following is true
690 * thisrr->type is the type of record
691 * thisrr->length == number of bytes in record
692 * thisrr->off == offset to first valid byte
693 * thisrr->data == where to take bytes from, increment after use :-).
696 /* just read a 0 length packet */
697 if (thisrr->length == 0) {
698 RECORD_LAYER_inc_empty_record_count(&s->rlayer);
699 if (RECORD_LAYER_get_empty_record_count(&s->rlayer)
700 > MAX_EMPTY_RECORDS) {
701 al = SSL_AD_UNEXPECTED_MESSAGE;
702 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_RECORD_TOO_SMALL);
706 RECORD_LAYER_reset_empty_record_count(&s->rlayer);
710 if (s->early_data_state == SSL_EARLY_DATA_READING) {
712 if (thisrr->type == SSL3_RT_APPLICATION_DATA
713 && !early_data_count_ok(s, thisrr->length, 0, &al))
717 RECORD_LAYER_set_numrpipes(&s->rlayer, num_recs);
721 ssl3_send_alert(s, SSL3_AL_FATAL, al);
726 int ssl3_do_uncompress(SSL *ssl, SSL3_RECORD *rr)
728 #ifndef OPENSSL_NO_COMP
731 if (rr->comp == NULL) {
732 rr->comp = (unsigned char *)
733 OPENSSL_malloc(SSL3_RT_MAX_ENCRYPTED_LENGTH);
735 if (rr->comp == NULL)
738 /* TODO(size_t): Convert this call */
739 i = COMP_expand_block(ssl->expand, rr->comp,
740 SSL3_RT_MAX_PLAIN_LENGTH, rr->data, (int)rr->length);
750 int ssl3_do_compress(SSL *ssl, SSL3_RECORD *wr)
752 #ifndef OPENSSL_NO_COMP
755 /* TODO(size_t): Convert this call */
756 i = COMP_compress_block(ssl->compress, wr->data,
757 (int)(wr->length + SSL3_RT_MAX_COMPRESSED_OVERHEAD),
758 wr->input, (int)wr->length);
764 wr->input = wr->data;
770 * ssl3_enc encrypts/decrypts |n_recs| records in |inrecs|
773 * 0: (in non-constant time) if the record is publically invalid (i.e. too
775 * 1: if the record's padding is valid / the encryption was successful.
776 * -1: if the record's padding is invalid or, if sending, an internal error
779 int ssl3_enc(SSL *s, SSL3_RECORD *inrecs, size_t n_recs, int sending)
784 size_t bs, mac_size = 0;
786 const EVP_CIPHER *enc;
790 * We shouldn't ever be called with more than one record in the SSLv3 case
795 ds = s->enc_write_ctx;
796 if (s->enc_write_ctx == NULL)
799 enc = EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
801 ds = s->enc_read_ctx;
802 if (s->enc_read_ctx == NULL)
805 enc = EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
808 if ((s->session == NULL) || (ds == NULL) || (enc == NULL)) {
809 memmove(rec->data, rec->input, rec->length);
810 rec->input = rec->data;
813 /* TODO(size_t): Convert this call */
814 bs = EVP_CIPHER_CTX_block_size(ds);
818 if ((bs != 1) && sending) {
821 /* we need to add 'i-1' padding bytes */
824 * the last of these zero bytes will be overwritten with the
827 memset(&rec->input[rec->length], 0, i);
829 rec->input[l - 1] = (unsigned char)(i - 1);
833 if (l == 0 || l % bs != 0)
835 /* otherwise, rec->length >= bs */
838 /* TODO(size_t): Convert this call */
839 if (EVP_Cipher(ds, rec->data, rec->input, (unsigned int)l) < 1)
842 if (EVP_MD_CTX_md(s->read_hash) != NULL) {
843 /* TODO(size_t): convert me */
844 imac_size = EVP_MD_CTX_size(s->read_hash);
847 mac_size = (size_t)imac_size;
849 if ((bs != 1) && !sending)
850 return ssl3_cbc_remove_padding(rec, bs, mac_size);
855 #define MAX_PADDING 256
857 * tls1_enc encrypts/decrypts |n_recs| in |recs|.
860 * 0: (in non-constant time) if the record is publically invalid (i.e. too
862 * 1: if the record's padding is valid / the encryption was successful.
863 * -1: if the record's padding/AEAD-authenticator is invalid or, if sending,
864 * an internal error occurred.
866 int tls1_enc(SSL *s, SSL3_RECORD *recs, size_t n_recs, int sending)
869 size_t reclen[SSL_MAX_PIPELINES];
870 unsigned char buf[SSL_MAX_PIPELINES][EVP_AEAD_TLS1_AAD_LEN];
871 int i, pad = 0, ret, tmpr;
872 size_t bs, mac_size = 0, ctr, padnum, loop;
873 unsigned char padval;
875 const EVP_CIPHER *enc;
881 if (EVP_MD_CTX_md(s->write_hash)) {
882 int n = EVP_MD_CTX_size(s->write_hash);
883 if (!ossl_assert(n >= 0)) {
884 SSLerr(SSL_F_TLS1_ENC, ERR_R_INTERNAL_ERROR);
888 ds = s->enc_write_ctx;
889 if (s->enc_write_ctx == NULL)
893 enc = EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
894 /* For TLSv1.1 and later explicit IV */
895 if (SSL_USE_EXPLICIT_IV(s)
896 && EVP_CIPHER_mode(enc) == EVP_CIPH_CBC_MODE)
897 ivlen = EVP_CIPHER_iv_length(enc);
901 for (ctr = 0; ctr < n_recs; ctr++) {
902 if (recs[ctr].data != recs[ctr].input) {
904 * we can't write into the input stream: Can this ever
907 SSLerr(SSL_F_TLS1_ENC, ERR_R_INTERNAL_ERROR);
909 } else if (ssl_randbytes(s, recs[ctr].input, ivlen) <= 0) {
910 SSLerr(SSL_F_TLS1_ENC, ERR_R_INTERNAL_ERROR);
917 if (EVP_MD_CTX_md(s->read_hash)) {
918 int n = EVP_MD_CTX_size(s->read_hash);
919 if (!ossl_assert(n >= 0)) {
920 SSLerr(SSL_F_TLS1_ENC, ERR_R_INTERNAL_ERROR);
924 ds = s->enc_read_ctx;
925 if (s->enc_read_ctx == NULL)
928 enc = EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
931 if ((s->session == NULL) || (ds == NULL) || (enc == NULL)) {
932 for (ctr = 0; ctr < n_recs; ctr++) {
933 memmove(recs[ctr].data, recs[ctr].input, recs[ctr].length);
934 recs[ctr].input = recs[ctr].data;
938 bs = EVP_CIPHER_block_size(EVP_CIPHER_CTX_cipher(ds));
941 if (!(EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ds))
942 & EVP_CIPH_FLAG_PIPELINE)) {
944 * We shouldn't have been called with pipeline data if the
945 * cipher doesn't support pipelining
947 SSLerr(SSL_F_TLS1_ENC, SSL_R_PIPELINE_FAILURE);
951 for (ctr = 0; ctr < n_recs; ctr++) {
952 reclen[ctr] = recs[ctr].length;
954 if (EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ds))
955 & EVP_CIPH_FLAG_AEAD_CIPHER) {
958 seq = sending ? RECORD_LAYER_get_write_sequence(&s->rlayer)
959 : RECORD_LAYER_get_read_sequence(&s->rlayer);
961 if (SSL_IS_DTLS(s)) {
962 /* DTLS does not support pipelining */
963 unsigned char dtlsseq[9], *p = dtlsseq;
965 s2n(sending ? DTLS_RECORD_LAYER_get_w_epoch(&s->rlayer) :
966 DTLS_RECORD_LAYER_get_r_epoch(&s->rlayer), p);
967 memcpy(p, &seq[2], 6);
968 memcpy(buf[ctr], dtlsseq, 8);
970 memcpy(buf[ctr], seq, 8);
971 for (i = 7; i >= 0; i--) { /* increment */
978 buf[ctr][8] = recs[ctr].type;
979 buf[ctr][9] = (unsigned char)(s->version >> 8);
980 buf[ctr][10] = (unsigned char)(s->version);
981 buf[ctr][11] = (unsigned char)(recs[ctr].length >> 8);
982 buf[ctr][12] = (unsigned char)(recs[ctr].length & 0xff);
983 pad = EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_AEAD_TLS1_AAD,
984 EVP_AEAD_TLS1_AAD_LEN, buf[ctr]);
990 recs[ctr].length += pad;
993 } else if ((bs != 1) && sending) {
994 padnum = bs - (reclen[ctr] % bs);
996 /* Add weird padding of upto 256 bytes */
998 if (padnum > MAX_PADDING)
1000 /* we need to add 'padnum' padding bytes of value padval */
1001 padval = (unsigned char)(padnum - 1);
1002 for (loop = reclen[ctr]; loop < reclen[ctr] + padnum; loop++)
1003 recs[ctr].input[loop] = padval;
1004 reclen[ctr] += padnum;
1005 recs[ctr].length += padnum;
1009 if (reclen[ctr] == 0 || reclen[ctr] % bs != 0)
1014 unsigned char *data[SSL_MAX_PIPELINES];
1016 /* Set the output buffers */
1017 for (ctr = 0; ctr < n_recs; ctr++) {
1018 data[ctr] = recs[ctr].data;
1020 if (EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_SET_PIPELINE_OUTPUT_BUFS,
1021 (int)n_recs, data) <= 0) {
1022 SSLerr(SSL_F_TLS1_ENC, SSL_R_PIPELINE_FAILURE);
1024 /* Set the input buffers */
1025 for (ctr = 0; ctr < n_recs; ctr++) {
1026 data[ctr] = recs[ctr].input;
1028 if (EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_SET_PIPELINE_INPUT_BUFS,
1029 (int)n_recs, data) <= 0
1030 || EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_SET_PIPELINE_INPUT_LENS,
1031 (int)n_recs, reclen) <= 0) {
1032 SSLerr(SSL_F_TLS1_ENC, SSL_R_PIPELINE_FAILURE);
1037 /* TODO(size_t): Convert this call */
1038 tmpr = EVP_Cipher(ds, recs[0].data, recs[0].input,
1039 (unsigned int)reclen[0]);
1040 if ((EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ds))
1041 & EVP_CIPH_FLAG_CUSTOM_CIPHER)
1044 return -1; /* AEAD can fail to verify MAC */
1046 if (EVP_CIPHER_mode(enc) == EVP_CIPH_GCM_MODE) {
1047 for (ctr = 0; ctr < n_recs; ctr++) {
1048 recs[ctr].data += EVP_GCM_TLS_EXPLICIT_IV_LEN;
1049 recs[ctr].input += EVP_GCM_TLS_EXPLICIT_IV_LEN;
1050 recs[ctr].length -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
1052 } else if (EVP_CIPHER_mode(enc) == EVP_CIPH_CCM_MODE) {
1053 for (ctr = 0; ctr < n_recs; ctr++) {
1054 recs[ctr].data += EVP_CCM_TLS_EXPLICIT_IV_LEN;
1055 recs[ctr].input += EVP_CCM_TLS_EXPLICIT_IV_LEN;
1056 recs[ctr].length -= EVP_CCM_TLS_EXPLICIT_IV_LEN;
1062 if (!SSL_READ_ETM(s) && EVP_MD_CTX_md(s->read_hash) != NULL) {
1063 imac_size = EVP_MD_CTX_size(s->read_hash);
1066 mac_size = (size_t)imac_size;
1068 if ((bs != 1) && !sending) {
1070 for (ctr = 0; ctr < n_recs; ctr++) {
1071 tmpret = tls1_cbc_remove_padding(s, &recs[ctr], bs, mac_size);
1073 * If tmpret == 0 then this means publicly invalid so we can
1074 * short circuit things here. Otherwise we must respect constant
1079 ret = constant_time_select_int(constant_time_eq_int(tmpret, 1),
1083 if (pad && !sending) {
1084 for (ctr = 0; ctr < n_recs; ctr++) {
1085 recs[ctr].length -= pad;
1092 int n_ssl3_mac(SSL *ssl, SSL3_RECORD *rec, unsigned char *md, int sending)
1094 unsigned char *mac_sec, *seq;
1095 const EVP_MD_CTX *hash;
1096 unsigned char *p, rec_char;
1102 mac_sec = &(ssl->s3->write_mac_secret[0]);
1103 seq = RECORD_LAYER_get_write_sequence(&ssl->rlayer);
1104 hash = ssl->write_hash;
1106 mac_sec = &(ssl->s3->read_mac_secret[0]);
1107 seq = RECORD_LAYER_get_read_sequence(&ssl->rlayer);
1108 hash = ssl->read_hash;
1111 t = EVP_MD_CTX_size(hash);
1115 npad = (48 / md_size) * md_size;
1118 EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
1119 ssl3_cbc_record_digest_supported(hash)) {
1121 * This is a CBC-encrypted record. We must avoid leaking any
1122 * timing-side channel information about how many blocks of data we
1123 * are hashing because that gives an attacker a timing-oracle.
1127 * npad is, at most, 48 bytes and that's with MD5:
1128 * 16 + 48 + 8 (sequence bytes) + 1 + 2 = 75.
1130 * With SHA-1 (the largest hash speced for SSLv3) the hash size
1131 * goes up 4, but npad goes down by 8, resulting in a smaller
1134 unsigned char header[75];
1136 memcpy(header + j, mac_sec, md_size);
1138 memcpy(header + j, ssl3_pad_1, npad);
1140 memcpy(header + j, seq, 8);
1142 header[j++] = rec->type;
1143 header[j++] = (unsigned char)(rec->length >> 8);
1144 header[j++] = (unsigned char)(rec->length & 0xff);
1146 /* Final param == is SSLv3 */
1147 if (ssl3_cbc_digest_record(hash,
1150 rec->length + md_size, rec->orig_len,
1151 mac_sec, md_size, 1) <= 0)
1154 unsigned int md_size_u;
1155 /* Chop the digest off the end :-) */
1156 EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();
1161 rec_char = rec->type;
1163 s2n(rec->length, p);
1164 if (EVP_MD_CTX_copy_ex(md_ctx, hash) <= 0
1165 || EVP_DigestUpdate(md_ctx, mac_sec, md_size) <= 0
1166 || EVP_DigestUpdate(md_ctx, ssl3_pad_1, npad) <= 0
1167 || EVP_DigestUpdate(md_ctx, seq, 8) <= 0
1168 || EVP_DigestUpdate(md_ctx, &rec_char, 1) <= 0
1169 || EVP_DigestUpdate(md_ctx, md, 2) <= 0
1170 || EVP_DigestUpdate(md_ctx, rec->input, rec->length) <= 0
1171 || EVP_DigestFinal_ex(md_ctx, md, NULL) <= 0
1172 || EVP_MD_CTX_copy_ex(md_ctx, hash) <= 0
1173 || EVP_DigestUpdate(md_ctx, mac_sec, md_size) <= 0
1174 || EVP_DigestUpdate(md_ctx, ssl3_pad_2, npad) <= 0
1175 || EVP_DigestUpdate(md_ctx, md, md_size) <= 0
1176 || EVP_DigestFinal_ex(md_ctx, md, &md_size_u) <= 0) {
1177 EVP_MD_CTX_reset(md_ctx);
1181 EVP_MD_CTX_free(md_ctx);
1184 ssl3_record_sequence_update(seq);
1188 int tls1_mac(SSL *ssl, SSL3_RECORD *rec, unsigned char *md, int sending)
1194 EVP_MD_CTX *hmac = NULL, *mac_ctx;
1195 unsigned char header[13];
1196 int stream_mac = (sending ? (ssl->mac_flags & SSL_MAC_FLAG_WRITE_MAC_STREAM)
1197 : (ssl->mac_flags & SSL_MAC_FLAG_READ_MAC_STREAM));
1201 seq = RECORD_LAYER_get_write_sequence(&ssl->rlayer);
1202 hash = ssl->write_hash;
1204 seq = RECORD_LAYER_get_read_sequence(&ssl->rlayer);
1205 hash = ssl->read_hash;
1208 t = EVP_MD_CTX_size(hash);
1209 if (!ossl_assert(t >= 0))
1213 /* I should fix this up TLS TLS TLS TLS TLS XXXXXXXX */
1217 hmac = EVP_MD_CTX_new();
1218 if (hmac == NULL || !EVP_MD_CTX_copy(hmac, hash))
1223 if (SSL_IS_DTLS(ssl)) {
1224 unsigned char dtlsseq[8], *p = dtlsseq;
1226 s2n(sending ? DTLS_RECORD_LAYER_get_w_epoch(&ssl->rlayer) :
1227 DTLS_RECORD_LAYER_get_r_epoch(&ssl->rlayer), p);
1228 memcpy(p, &seq[2], 6);
1230 memcpy(header, dtlsseq, 8);
1232 memcpy(header, seq, 8);
1234 header[8] = rec->type;
1235 header[9] = (unsigned char)(ssl->version >> 8);
1236 header[10] = (unsigned char)(ssl->version);
1237 header[11] = (unsigned char)(rec->length >> 8);
1238 header[12] = (unsigned char)(rec->length & 0xff);
1240 if (!sending && !SSL_READ_ETM(ssl) &&
1241 EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
1242 ssl3_cbc_record_digest_supported(mac_ctx)) {
1244 * This is a CBC-encrypted record. We must avoid leaking any
1245 * timing-side channel information about how many blocks of data we
1246 * are hashing because that gives an attacker a timing-oracle.
1248 /* Final param == not SSLv3 */
1249 if (ssl3_cbc_digest_record(mac_ctx,
1252 rec->length + md_size, rec->orig_len,
1253 ssl->s3->read_mac_secret,
1254 ssl->s3->read_mac_secret_size, 0) <= 0) {
1255 EVP_MD_CTX_free(hmac);
1259 /* TODO(size_t): Convert these calls */
1260 if (EVP_DigestSignUpdate(mac_ctx, header, sizeof(header)) <= 0
1261 || EVP_DigestSignUpdate(mac_ctx, rec->input, rec->length) <= 0
1262 || EVP_DigestSignFinal(mac_ctx, md, &md_size) <= 0) {
1263 EVP_MD_CTX_free(hmac);
1268 EVP_MD_CTX_free(hmac);
1271 fprintf(stderr, "seq=");
1274 for (z = 0; z < 8; z++)
1275 fprintf(stderr, "%02X ", seq[z]);
1276 fprintf(stderr, "\n");
1278 fprintf(stderr, "rec=");
1281 for (z = 0; z < rec->length; z++)
1282 fprintf(stderr, "%02X ", rec->data[z]);
1283 fprintf(stderr, "\n");
1287 if (!SSL_IS_DTLS(ssl)) {
1288 for (i = 7; i >= 0; i--) {
1297 for (z = 0; z < md_size; z++)
1298 fprintf(stderr, "%02X ", md[z]);
1299 fprintf(stderr, "\n");
1306 * ssl3_cbc_remove_padding removes padding from the decrypted, SSLv3, CBC
1307 * record in |rec| by updating |rec->length| in constant time.
1309 * block_size: the block size of the cipher used to encrypt the record.
1311 * 0: (in non-constant time) if the record is publicly invalid.
1312 * 1: if the padding was valid
1315 int ssl3_cbc_remove_padding(SSL3_RECORD *rec,
1316 size_t block_size, size_t mac_size)
1318 size_t padding_length;
1320 const size_t overhead = 1 /* padding length byte */ + mac_size;
1323 * These lengths are all public so we can test them in non-constant time.
1325 if (overhead > rec->length)
1328 padding_length = rec->data[rec->length - 1];
1329 good = constant_time_ge_s(rec->length, padding_length + overhead);
1330 /* SSLv3 requires that the padding is minimal. */
1331 good &= constant_time_ge_s(block_size, padding_length + 1);
1332 rec->length -= good & (padding_length + 1);
1333 return constant_time_select_int_s(good, 1, -1);
1337 * tls1_cbc_remove_padding removes the CBC padding from the decrypted, TLS, CBC
1338 * record in |rec| in constant time and returns 1 if the padding is valid and
1339 * -1 otherwise. It also removes any explicit IV from the start of the record
1340 * without leaking any timing about whether there was enough space after the
1341 * padding was removed.
1343 * block_size: the block size of the cipher used to encrypt the record.
1345 * 0: (in non-constant time) if the record is publicly invalid.
1346 * 1: if the padding was valid
1349 int tls1_cbc_remove_padding(const SSL *s,
1351 size_t block_size, size_t mac_size)
1354 size_t padding_length, to_check, i;
1355 const size_t overhead = 1 /* padding length byte */ + mac_size;
1356 /* Check if version requires explicit IV */
1357 if (SSL_USE_EXPLICIT_IV(s)) {
1359 * These lengths are all public so we can test them in non-constant
1362 if (overhead + block_size > rec->length)
1364 /* We can now safely skip explicit IV */
1365 rec->data += block_size;
1366 rec->input += block_size;
1367 rec->length -= block_size;
1368 rec->orig_len -= block_size;
1369 } else if (overhead > rec->length)
1372 padding_length = rec->data[rec->length - 1];
1374 if (EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(s->enc_read_ctx)) &
1375 EVP_CIPH_FLAG_AEAD_CIPHER) {
1376 /* padding is already verified */
1377 rec->length -= padding_length + 1;
1381 good = constant_time_ge_s(rec->length, overhead + padding_length);
1383 * The padding consists of a length byte at the end of the record and
1384 * then that many bytes of padding, all with the same value as the length
1385 * byte. Thus, with the length byte included, there are i+1 bytes of
1386 * padding. We can't check just |padding_length+1| bytes because that
1387 * leaks decrypted information. Therefore we always have to check the
1388 * maximum amount of padding possible. (Again, the length of the record
1389 * is public information so we can use it.)
1391 to_check = 256; /* maximum amount of padding, inc length byte. */
1392 if (to_check > rec->length)
1393 to_check = rec->length;
1395 for (i = 0; i < to_check; i++) {
1396 unsigned char mask = constant_time_ge_8_s(padding_length, i);
1397 unsigned char b = rec->data[rec->length - 1 - i];
1399 * The final |padding_length+1| bytes should all have the value
1400 * |padding_length|. Therefore the XOR should be zero.
1402 good &= ~(mask & (padding_length ^ b));
1406 * If any of the final |padding_length+1| bytes had the wrong value, one
1407 * or more of the lower eight bits of |good| will be cleared.
1409 good = constant_time_eq_s(0xff, good & 0xff);
1410 rec->length -= good & (padding_length + 1);
1412 return constant_time_select_int_s(good, 1, -1);
1416 * ssl3_cbc_copy_mac copies |md_size| bytes from the end of |rec| to |out| in
1417 * constant time (independent of the concrete value of rec->length, which may
1418 * vary within a 256-byte window).
1420 * ssl3_cbc_remove_padding or tls1_cbc_remove_padding must be called prior to
1424 * rec->orig_len >= md_size
1425 * md_size <= EVP_MAX_MD_SIZE
1427 * If CBC_MAC_ROTATE_IN_PLACE is defined then the rotation is performed with
1428 * variable accesses in a 64-byte-aligned buffer. Assuming that this fits into
1429 * a single or pair of cache-lines, then the variable memory accesses don't
1430 * actually affect the timing. CPUs with smaller cache-lines [if any] are
1431 * not multi-core and are not considered vulnerable to cache-timing attacks.
1433 #define CBC_MAC_ROTATE_IN_PLACE
1435 int ssl3_cbc_copy_mac(unsigned char *out,
1436 const SSL3_RECORD *rec, size_t md_size)
1438 #if defined(CBC_MAC_ROTATE_IN_PLACE)
1439 unsigned char rotated_mac_buf[64 + EVP_MAX_MD_SIZE];
1440 unsigned char *rotated_mac;
1442 unsigned char rotated_mac[EVP_MAX_MD_SIZE];
1446 * mac_end is the index of |rec->data| just after the end of the MAC.
1448 size_t mac_end = rec->length;
1449 size_t mac_start = mac_end - md_size;
1452 * scan_start contains the number of bytes that we can ignore because the
1453 * MAC's position can only vary by 255 bytes.
1455 size_t scan_start = 0;
1457 size_t rotate_offset;
1459 if (!ossl_assert(rec->orig_len >= md_size
1460 && md_size <= EVP_MAX_MD_SIZE))
1463 #if defined(CBC_MAC_ROTATE_IN_PLACE)
1464 rotated_mac = rotated_mac_buf + ((0 - (size_t)rotated_mac_buf) & 63);
1467 /* This information is public so it's safe to branch based on it. */
1468 if (rec->orig_len > md_size + 255 + 1)
1469 scan_start = rec->orig_len - (md_size + 255 + 1);
1473 memset(rotated_mac, 0, md_size);
1474 for (i = scan_start, j = 0; i < rec->orig_len; i++) {
1475 size_t mac_started = constant_time_eq_s(i, mac_start);
1476 size_t mac_ended = constant_time_lt_s(i, mac_end);
1477 unsigned char b = rec->data[i];
1479 in_mac |= mac_started;
1480 in_mac &= mac_ended;
1481 rotate_offset |= j & mac_started;
1482 rotated_mac[j++] |= b & in_mac;
1483 j &= constant_time_lt_s(j, md_size);
1486 /* Now rotate the MAC */
1487 #if defined(CBC_MAC_ROTATE_IN_PLACE)
1489 for (i = 0; i < md_size; i++) {
1490 /* in case cache-line is 32 bytes, touch second line */
1491 ((volatile unsigned char *)rotated_mac)[rotate_offset ^ 32];
1492 out[j++] = rotated_mac[rotate_offset++];
1493 rotate_offset &= constant_time_lt_s(rotate_offset, md_size);
1496 memset(out, 0, md_size);
1497 rotate_offset = md_size - rotate_offset;
1498 rotate_offset &= constant_time_lt_s(rotate_offset, md_size);
1499 for (i = 0; i < md_size; i++) {
1500 for (j = 0; j < md_size; j++)
1501 out[j] |= rotated_mac[i] & constant_time_eq_8_s(j, rotate_offset);
1503 rotate_offset &= constant_time_lt_s(rotate_offset, md_size);
1510 int dtls1_process_record(SSL *s, DTLS1_BITMAP *bitmap)
1518 unsigned char md[EVP_MAX_MD_SIZE];
1520 rr = RECORD_LAYER_get_rrec(&s->rlayer);
1524 * At this point, s->packet_length == SSL3_RT_HEADER_LNGTH + rr->length,
1525 * and we have that many bytes in s->packet
1527 rr->input = &(RECORD_LAYER_get_packet(&s->rlayer)[DTLS1_RT_HEADER_LENGTH]);
1530 * ok, we can now read from 's->packet' data into 'rr' rr->input points
1531 * at rr->length bytes, which need to be copied into rr->data by either
1532 * the decryption or by the decompression When the data is 'copied' into
1533 * the rr->data buffer, rr->input will be pointed at the new buffer
1537 * We now have - encrypted [ MAC [ compressed [ plain ] ] ] rr->length
1538 * bytes of encrypted compressed stuff.
1541 /* check is not needed I believe */
1542 if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH) {
1543 al = SSL_AD_RECORD_OVERFLOW;
1544 SSLerr(SSL_F_DTLS1_PROCESS_RECORD, SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
1548 /* decrypt in place in 'rr->input' */
1549 rr->data = rr->input;
1550 rr->orig_len = rr->length;
1552 if (SSL_READ_ETM(s) && s->read_hash) {
1554 mac_size = EVP_MD_CTX_size(s->read_hash);
1555 if (!ossl_assert(mac_size <= EVP_MAX_MD_SIZE)) {
1556 al = SSL_AD_INTERNAL_ERROR;
1557 SSLerr(SSL_F_DTLS1_PROCESS_RECORD, ERR_R_INTERNAL_ERROR);
1560 if (rr->orig_len < mac_size) {
1561 al = SSL_AD_DECODE_ERROR;
1562 SSLerr(SSL_F_DTLS1_PROCESS_RECORD, SSL_R_LENGTH_TOO_SHORT);
1565 rr->length -= mac_size;
1566 mac = rr->data + rr->length;
1567 i = s->method->ssl3_enc->mac(s, rr, md, 0 /* not send */ );
1568 if (i == 0 || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0) {
1569 al = SSL_AD_BAD_RECORD_MAC;
1570 SSLerr(SSL_F_DTLS1_PROCESS_RECORD,
1571 SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
1576 enc_err = s->method->ssl3_enc->enc(s, rr, 1, 0);
1579 * 0: (in non-constant time) if the record is publically invalid.
1580 * 1: if the padding is valid
1581 * -1: if the padding is invalid
1584 /* For DTLS we simply ignore bad packets. */
1586 RECORD_LAYER_reset_packet_length(&s->rlayer);
1590 printf("dec %ld\n", rr->length);
1593 for (z = 0; z < rr->length; z++)
1594 printf("%02X%c", rr->data[z], ((z + 1) % 16) ? ' ' : '\n');
1599 /* r->length is now the compressed data plus mac */
1600 if ((sess != NULL) && !SSL_READ_ETM(s) &&
1601 (s->enc_read_ctx != NULL) && (EVP_MD_CTX_md(s->read_hash) != NULL)) {
1602 /* s->read_hash != NULL => mac_size != -1 */
1603 unsigned char *mac = NULL;
1604 unsigned char mac_tmp[EVP_MAX_MD_SIZE];
1606 /* TODO(size_t): Convert this to do size_t properly */
1607 imac_size = EVP_MD_CTX_size(s->read_hash);
1608 if (imac_size < 0) {
1609 al = SSL_AD_INTERNAL_ERROR;
1610 SSLerr(SSL_F_DTLS1_PROCESS_RECORD, ERR_LIB_EVP);
1613 mac_size = (size_t)imac_size;
1614 if (!ossl_assert(mac_size <= EVP_MAX_MD_SIZE)) {
1615 al = SSL_AD_INTERNAL_ERROR;
1616 SSLerr(SSL_F_DTLS1_PROCESS_RECORD, ERR_R_INTERNAL_ERROR);
1621 * orig_len is the length of the record before any padding was
1622 * removed. This is public information, as is the MAC in use,
1623 * therefore we can safely process the record in a different amount
1624 * of time if it's too short to possibly contain a MAC.
1626 if (rr->orig_len < mac_size ||
1627 /* CBC records must have a padding length byte too. */
1628 (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
1629 rr->orig_len < mac_size + 1)) {
1630 al = SSL_AD_DECODE_ERROR;
1631 SSLerr(SSL_F_DTLS1_PROCESS_RECORD, SSL_R_LENGTH_TOO_SHORT);
1635 if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE) {
1637 * We update the length so that the TLS header bytes can be
1638 * constructed correctly but we need to extract the MAC in
1639 * constant time from within the record, without leaking the
1640 * contents of the padding bytes.
1643 if (!ssl3_cbc_copy_mac(mac_tmp, rr, mac_size)) {
1644 al = SSL_AD_INTERNAL_ERROR;
1645 SSLerr(SSL_F_DTLS1_PROCESS_RECORD, ERR_R_INTERNAL_ERROR);
1648 rr->length -= mac_size;
1651 * In this case there's no padding, so |rec->orig_len| equals
1652 * |rec->length| and we checked that there's enough bytes for
1655 rr->length -= mac_size;
1656 mac = &rr->data[rr->length];
1659 i = s->method->ssl3_enc->mac(s, rr, md, 0 /* not send */ );
1660 if (i == 0 || mac == NULL
1661 || CRYPTO_memcmp(md, mac, mac_size) != 0)
1663 if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH + mac_size)
1668 /* decryption failed, silently discard message */
1670 RECORD_LAYER_reset_packet_length(&s->rlayer);
1674 /* r->length is now just compressed */
1675 if (s->expand != NULL) {
1676 if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH) {
1677 al = SSL_AD_RECORD_OVERFLOW;
1678 SSLerr(SSL_F_DTLS1_PROCESS_RECORD,
1679 SSL_R_COMPRESSED_LENGTH_TOO_LONG);
1682 if (!ssl3_do_uncompress(s, rr)) {
1683 al = SSL_AD_DECOMPRESSION_FAILURE;
1684 SSLerr(SSL_F_DTLS1_PROCESS_RECORD, SSL_R_BAD_DECOMPRESSION);
1689 if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH) {
1690 al = SSL_AD_RECORD_OVERFLOW;
1691 SSLerr(SSL_F_DTLS1_PROCESS_RECORD, SSL_R_DATA_LENGTH_TOO_LONG);
1697 * So at this point the following is true
1698 * ssl->s3->rrec.type is the type of record
1699 * ssl->s3->rrec.length == number of bytes in record
1700 * ssl->s3->rrec.off == offset to first valid byte
1701 * ssl->s3->rrec.data == where to take bytes from, increment
1705 /* we have pulled in a full packet so zero things */
1706 RECORD_LAYER_reset_packet_length(&s->rlayer);
1708 /* Mark receipt of record. */
1709 dtls1_record_bitmap_update(s, bitmap);
1714 ssl3_send_alert(s, SSL3_AL_FATAL, al);
1720 * Retrieve a buffered record that belongs to the current epoch, i.e. processed
1722 #define dtls1_get_processed_record(s) \
1723 dtls1_retrieve_buffered_record((s), \
1724 &(DTLS_RECORD_LAYER_get_processed_rcds(&s->rlayer)))
1727 * Call this to get a new input record.
1728 * It will return <= 0 if more data is needed, normally due to an error
1729 * or non-blocking IO.
1730 * When it finishes, one packet has been decoded and can be found in
1731 * ssl->s3->rrec.type - is the type of record
1732 * ssl->s3->rrec.data, - data
1733 * ssl->s3->rrec.length, - number of bytes
1735 /* used only by dtls1_read_bytes */
1736 int dtls1_get_record(SSL *s)
1738 int ssl_major, ssl_minor;
1742 unsigned char *p = NULL;
1743 unsigned short version;
1744 DTLS1_BITMAP *bitmap;
1745 unsigned int is_next_epoch;
1747 rr = RECORD_LAYER_get_rrec(&s->rlayer);
1751 * The epoch may have changed. If so, process all the pending records.
1752 * This is a non-blocking operation.
1754 if (!dtls1_process_buffered_records(s))
1757 /* if we're renegotiating, then there may be buffered records */
1758 if (dtls1_get_processed_record(s))
1761 /* get something from the wire */
1763 /* check if we have the header */
1764 if ((RECORD_LAYER_get_rstate(&s->rlayer) != SSL_ST_READ_BODY) ||
1765 (RECORD_LAYER_get_packet_length(&s->rlayer) < DTLS1_RT_HEADER_LENGTH)) {
1766 rret = ssl3_read_n(s, DTLS1_RT_HEADER_LENGTH,
1767 SSL3_BUFFER_get_len(&s->rlayer.rbuf), 0, 1, &n);
1768 /* read timeout is handled by dtls1_read_bytes */
1770 return rret; /* error or non-blocking */
1772 /* this packet contained a partial record, dump it */
1773 if (RECORD_LAYER_get_packet_length(&s->rlayer) !=
1774 DTLS1_RT_HEADER_LENGTH) {
1775 RECORD_LAYER_reset_packet_length(&s->rlayer);
1779 RECORD_LAYER_set_rstate(&s->rlayer, SSL_ST_READ_BODY);
1781 p = RECORD_LAYER_get_packet(&s->rlayer);
1783 if (s->msg_callback)
1784 s->msg_callback(0, 0, SSL3_RT_HEADER, p, DTLS1_RT_HEADER_LENGTH,
1785 s, s->msg_callback_arg);
1787 /* Pull apart the header into the DTLS1_RECORD */
1791 version = (ssl_major << 8) | ssl_minor;
1793 /* sequence number is 64 bits, with top 2 bytes = epoch */
1796 memcpy(&(RECORD_LAYER_get_read_sequence(&s->rlayer)[2]), p, 6);
1801 /* Lets check version */
1802 if (!s->first_packet) {
1803 if (version != s->version) {
1804 /* unexpected version, silently discard */
1806 RECORD_LAYER_reset_packet_length(&s->rlayer);
1811 if ((version & 0xff00) != (s->version & 0xff00)) {
1812 /* wrong version, silently discard record */
1814 RECORD_LAYER_reset_packet_length(&s->rlayer);
1818 if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH) {
1819 /* record too long, silently discard it */
1821 RECORD_LAYER_reset_packet_length(&s->rlayer);
1825 /* now s->rlayer.rstate == SSL_ST_READ_BODY */
1828 /* s->rlayer.rstate == SSL_ST_READ_BODY, get and decode the data */
1831 RECORD_LAYER_get_packet_length(&s->rlayer) - DTLS1_RT_HEADER_LENGTH) {
1832 /* now s->packet_length == DTLS1_RT_HEADER_LENGTH */
1834 rret = ssl3_read_n(s, more, more, 1, 1, &n);
1835 /* this packet contained a partial record, dump it */
1836 if (rret <= 0 || n != more) {
1838 RECORD_LAYER_reset_packet_length(&s->rlayer);
1843 * now n == rr->length, and s->packet_length ==
1844 * DTLS1_RT_HEADER_LENGTH + rr->length
1847 /* set state for later operations */
1848 RECORD_LAYER_set_rstate(&s->rlayer, SSL_ST_READ_HEADER);
1850 /* match epochs. NULL means the packet is dropped on the floor */
1851 bitmap = dtls1_get_bitmap(s, rr, &is_next_epoch);
1852 if (bitmap == NULL) {
1854 RECORD_LAYER_reset_packet_length(&s->rlayer); /* dump this record */
1855 goto again; /* get another record */
1857 #ifndef OPENSSL_NO_SCTP
1858 /* Only do replay check if no SCTP bio */
1859 if (!BIO_dgram_is_sctp(SSL_get_rbio(s))) {
1861 /* Check whether this is a repeat, or aged record. */
1863 * TODO: Does it make sense to have replay protection in epoch 0 where
1864 * we have no integrity negotiated yet?
1866 if (!dtls1_record_replay_check(s, bitmap)) {
1868 RECORD_LAYER_reset_packet_length(&s->rlayer); /* dump this record */
1869 goto again; /* get another record */
1871 #ifndef OPENSSL_NO_SCTP
1875 /* just read a 0 length packet */
1876 if (rr->length == 0)
1880 * If this record is from the next epoch (either HM or ALERT), and a
1881 * handshake is currently in progress, buffer it since it cannot be
1882 * processed at this time.
1884 if (is_next_epoch) {
1885 if ((SSL_in_init(s) || ossl_statem_get_in_handshake(s))) {
1886 if (dtls1_buffer_record
1887 (s, &(DTLS_RECORD_LAYER_get_unprocessed_rcds(&s->rlayer)),
1892 RECORD_LAYER_reset_packet_length(&s->rlayer);
1896 if (!dtls1_process_record(s, bitmap)) {
1898 RECORD_LAYER_reset_packet_length(&s->rlayer); /* dump this record */
1899 goto again; /* get another record */