From dd7e60bd70730da4c9f8f542a6bd8951746ac2ca Mon Sep 17 00:00:00 2001 From: Andy Polyakov Date: Fri, 8 Feb 2013 10:20:48 +0100 Subject: [PATCH] ssl/*: revert "remove SSL_RECORD->orig_len" and merge "fix IV". Revert is appropriate because binary compatibility is not an issue in 1.1. --- ssl/d1_pkt.c | 12 +++++------ ssl/s3_cbc.c | 54 ++++++++++++++++++++------------------------------ ssl/s3_enc.c | 8 ++------ ssl/s3_pkt.c | 12 +++++------ ssl/ssl3.h | 4 ++++ ssl/ssl_locl.h | 2 +- ssl/t1_enc.c | 10 +++------- 7 files changed, 43 insertions(+), 59 deletions(-) diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c index 0ad8b5f559..02c881ab31 100644 --- a/ssl/d1_pkt.c +++ b/ssl/d1_pkt.c @@ -379,7 +379,7 @@ dtls1_process_record(SSL *s) int enc_err; SSL_SESSION *sess; SSL3_RECORD *rr; - unsigned int mac_size, orig_len; + unsigned int mac_size; unsigned char md[EVP_MAX_MD_SIZE]; rr= &(s->s3->rrec); @@ -410,7 +410,7 @@ dtls1_process_record(SSL *s) /* decrypt in place in 'rr->input' */ rr->data=rr->input; - orig_len=rr->length; + rr->orig_len=rr->length; enc_err = s->method->ssl3_enc->enc(s,0); /* enc_err is: @@ -447,10 +447,10 @@ printf("\n"); * therefore we can safely process the record in a different * amount of time if it's too short to possibly contain a MAC. */ - if (orig_len < mac_size || + if (rr->orig_len < mac_size || /* CBC records must have a padding length byte too. */ (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE && - orig_len < mac_size+1)) + rr->orig_len < mac_size+1)) { al=SSL_AD_DECODE_ERROR; SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT); @@ -465,12 +465,12 @@ printf("\n"); * without leaking the contents of the padding bytes. * */ mac = mac_tmp; - ssl3_cbc_copy_mac(mac_tmp, rr, mac_size, orig_len); + ssl3_cbc_copy_mac(mac_tmp, rr, mac_size); rr->length -= mac_size; } else { - /* In this case there's no padding, so |orig_len| + /* In this case there's no padding, so |rec->orig_len| * equals |rec->length| and we checked that there's * enough bytes for |mac_size| above. */ rr->length -= mac_size; diff --git a/ssl/s3_cbc.c b/ssl/s3_cbc.c index ce77acd3d4..2e9765e963 100644 --- a/ssl/s3_cbc.c +++ b/ssl/s3_cbc.c @@ -116,9 +116,7 @@ int ssl3_cbc_remove_padding(const SSL* s, good = constant_time_ge(rec->length, padding_length+overhead); /* SSLv3 requires that the padding is minimal. */ good &= constant_time_ge(block_size, padding_length+1); - padding_length = good & (padding_length+1); - rec->length -= padding_length; - rec->type |= padding_length<<8; /* kludge: pass padding length */ + rec->length -= good & (padding_length+1); return (int)((good & 1) | (~good & -1)); } @@ -139,31 +137,23 @@ int tls1_cbc_remove_padding(const SSL* s, unsigned mac_size) { unsigned padding_length, good, to_check, i; - const char has_explicit_iv = - s->version >= TLS1_1_VERSION || s->version == DTLS1_VERSION; - const unsigned overhead = 1 /* padding length byte */ + - mac_size + - (has_explicit_iv ? block_size : 0); - - /* These lengths are all public so we can test them in non-constant - * time. */ - if (overhead > rec->length) - return 0; - - /* We can always safely skip the explicit IV. We check at the beginning - * of this function that the record has at least enough space for the - * IV, MAC and padding length byte. (These can be checked in - * non-constant time because it's all public information.) So, if the - * padding was invalid, then we didn't change |rec->length| and this is - * safe. If the padding was valid then we know that we have at least - * overhead+padding_length bytes of space and so this is still safe - * because overhead accounts for the explicit IV. */ - if (has_explicit_iv) + const unsigned overhead = 1 /* padding length byte */ + mac_size; + /* Check if version requires explicit IV */ + if (s->version >= TLS1_1_VERSION || s->version == DTLS1_VERSION) { + /* These lengths are all public so we can test them in + * non-constant time. + */ + if (overhead + block_size > rec->length) + return 0; + /* We can now safely skip explicit IV */ rec->data += block_size; rec->input += block_size; rec->length -= block_size; + rec->orig_len -= block_size; } + else if (overhead > rec->length) + return 0; padding_length = rec->data[rec->length-1]; @@ -190,7 +180,7 @@ int tls1_cbc_remove_padding(const SSL* s, if (EVP_CIPHER_flags(s->enc_read_ctx->cipher)&EVP_CIPH_FLAG_AEAD_CIPHER) { /* padding is already verified */ - rec->length -= padding_length; + rec->length -= padding_length + 1; return 1; } @@ -227,9 +217,7 @@ int tls1_cbc_remove_padding(const SSL* s, good <<= sizeof(good)*8-1; good = DUPLICATE_MSB_TO_ALL(good); - padding_length = good & (padding_length+1); - rec->length -= padding_length; - rec->type |= padding_length<<8; /* kludge: pass padding length */ + rec->length -= good & (padding_length+1); return (int)((good & 1) | (~good & -1)); } @@ -256,7 +244,7 @@ int tls1_cbc_remove_padding(const SSL* s, */ void ssl3_cbc_copy_mac(unsigned char* out, const SSL3_RECORD *rec, - unsigned md_size,unsigned orig_len) + unsigned md_size) { #if defined(CBC_MAC_ROTATE_IN_PLACE) unsigned char rotated_mac_buf[EVP_MAX_MD_SIZE*2]; @@ -275,7 +263,7 @@ void ssl3_cbc_copy_mac(unsigned char* out, unsigned div_spoiler; unsigned rotate_offset; - OPENSSL_assert(orig_len >= md_size); + OPENSSL_assert(rec->orig_len >= md_size); OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE); #if defined(CBC_MAC_ROTATE_IN_PLACE) @@ -283,8 +271,8 @@ void ssl3_cbc_copy_mac(unsigned char* out, #endif /* This information is public so it's safe to branch based on it. */ - if (orig_len > md_size + 255 + 1) - scan_start = orig_len - (md_size + 255 + 1); + if (rec->orig_len > md_size + 255 + 1) + scan_start = rec->orig_len - (md_size + 255 + 1); /* div_spoiler contains a multiple of md_size that is used to cause the * modulo operation to be constant time. Without this, the time varies * based on the amount of padding when running on Intel chips at least. @@ -297,9 +285,9 @@ void ssl3_cbc_copy_mac(unsigned char* out, rotate_offset = (div_spoiler + mac_start - scan_start) % md_size; memset(rotated_mac, 0, md_size); - for (i = scan_start; i < orig_len;) + for (i = scan_start; i < rec->orig_len;) { - for (j = 0; j < md_size && i < orig_len; i++, j++) + for (j = 0; j < md_size && i < rec->orig_len; i++, j++) { unsigned char mac_started = constant_time_ge(i, mac_start); unsigned char mac_ended = constant_time_ge(i, mac_end); diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c index 196f0739d5..0282ef4620 100644 --- a/ssl/s3_enc.c +++ b/ssl/s3_enc.c @@ -730,7 +730,7 @@ int n_ssl3_mac(SSL *ssl, unsigned char *md, int send) EVP_MD_CTX md_ctx; const EVP_MD_CTX *hash; unsigned char *p,rec_char; - size_t md_size, orig_len; + size_t md_size; int npad; int t; @@ -755,10 +755,6 @@ int n_ssl3_mac(SSL *ssl, unsigned char *md, int send) md_size=t; npad=(48/md_size)*md_size; - /* kludge: ssl3_cbc_remove_padding passes padding length in rec->type */ - orig_len = rec->length+md_size+((unsigned int)rec->type>>8); - rec->type &= 0xff; - if (!send && EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE && ssl3_cbc_record_digest_supported(hash)) @@ -790,7 +786,7 @@ int n_ssl3_mac(SSL *ssl, unsigned char *md, int send) hash, md, &md_size, header, rec->input, - rec->length + md_size, orig_len, + rec->length + md_size, rec->orig_len, mac_sec, md_size, 1 /* is SSLv3 */); } diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c index 64cef2abfa..032a8558ed 100644 --- a/ssl/s3_pkt.c +++ b/ssl/s3_pkt.c @@ -290,7 +290,7 @@ static int ssl3_get_record(SSL *s) unsigned char *p; unsigned char md[EVP_MAX_MD_SIZE]; short version; - unsigned mac_size, orig_len; + unsigned mac_size; size_t extra; rr= &(s->s3->rrec); @@ -400,7 +400,7 @@ fprintf(stderr, "Record type=%d, Length=%d\n", rr->type, rr->length); /* decrypt in place in 'rr->input' */ rr->data=rr->input; - orig_len=rr->length; + rr->orig_len=rr->length; enc_err = s->method->ssl3_enc->enc(s,0); /* enc_err is: @@ -436,10 +436,10 @@ printf("\n"); * therefore we can safely process the record in a different * amount of time if it's too short to possibly contain a MAC. */ - if (orig_len < mac_size || + if (rr->orig_len < mac_size || /* CBC records must have a padding length byte too. */ (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE && - orig_len < mac_size+1)) + rr->orig_len < mac_size+1)) { al=SSL_AD_DECODE_ERROR; SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT); @@ -454,12 +454,12 @@ printf("\n"); * without leaking the contents of the padding bytes. * */ mac = mac_tmp; - ssl3_cbc_copy_mac(mac_tmp, rr, mac_size, orig_len); + ssl3_cbc_copy_mac(mac_tmp, rr, mac_size); rr->length -= mac_size; } else { - /* In this case there's no padding, so |orig_len| + /* In this case there's no padding, so |rec->orig_len| * equals |rec->length| and we checked that there's * enough bytes for |mac_size| above. */ rr->length -= mac_size; diff --git a/ssl/ssl3.h b/ssl/ssl3.h index d2a5208824..2486011bb5 100644 --- a/ssl/ssl3.h +++ b/ssl/ssl3.h @@ -366,6 +366,10 @@ typedef struct ssl3_record_st { /*r */ int type; /* type of record */ /*rw*/ unsigned int length; /* How many bytes available */ +/*rw*/ unsigned int orig_len; /* How many bytes were available before padding + was removed? This is used to implement the + MAC check in constant time for CBC records. + */ /*r */ unsigned int off; /* read/write offset into 'buf' */ /*rw*/ unsigned char *data; /* pointer to the record data */ /*rw*/ unsigned char *input; /* where the decode bytes are */ diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index 65c56bddc9..134198e91b 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -1275,7 +1275,7 @@ int ssl_parse_serverhello_use_srtp_ext(SSL *s, unsigned char *d, int len,int *al /* s3_cbc.c */ void ssl3_cbc_copy_mac(unsigned char* out, const SSL3_RECORD *rec, - unsigned md_size,unsigned orig_len); + unsigned md_size); int ssl3_cbc_remove_padding(const SSL* s, SSL3_RECORD *rec, unsigned block_size, diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c index 4e23bbf77b..e313355fa2 100644 --- a/ssl/t1_enc.c +++ b/ssl/t1_enc.c @@ -973,7 +973,7 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send) SSL3_RECORD *rec; unsigned char *seq; EVP_MD_CTX *hash; - size_t md_size, orig_len; + size_t md_size; int i; EVP_MD_CTX hmac, *mac_ctx; unsigned char header[13]; @@ -1020,10 +1020,6 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send) else memcpy(header, seq, 8); - /* kludge: tls1_cbc_remove_padding passes padding length in rec->type */ - orig_len = rec->length+md_size+((unsigned int)rec->type>>8); - rec->type &= 0xff; - header[8]=rec->type; header[9]=(unsigned char)(ssl->version>>8); header[10]=(unsigned char)(ssl->version); @@ -1042,7 +1038,7 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send) mac_ctx, md, &md_size, header, rec->input, - rec->length + md_size, orig_len, + rec->length + md_size, rec->orig_len, ssl->s3->read_mac_secret, ssl->s3->read_mac_secret_size, 0 /* not SSLv3 */); @@ -1058,7 +1054,7 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send) tls_fips_digest_extra( ssl->enc_read_ctx, mac_ctx, rec->input, - rec->length, orig_len); + rec->length, rec->orig_len); #endif } -- 2.25.1