mark all block comments that need format preserving so that

[openssl.git] / ssl / s3_cbc.c

diff --git a/ssl/s3_cbc.c b/ssl/s3_cbc.c
index 45a1495cbe8db5e8cb994dc2178f5f9a3269d92b..b672f400508e58fa979207fa2b12cf207a9483fe 100644 (file)
--- a/ssl/s3_cbc.c
+++ b/ssl/s3_cbc.c
@@ -68,14 +68,16 @@
  * supported by TLS.) */
 #define MAX_HASH_BLOCK_SIZE 128
 
-/* ssl3_cbc_remove_padding removes padding from the decrypted, SSLv3, CBC
+/*-
+ * ssl3_cbc_remove_padding removes padding from the decrypted, SSLv3, CBC
  * record in |rec| by updating |rec->length| in constant time.
  *
  * block_size: the block size of the cipher used to encrypt the record.
  * returns:
  *   0: (in non-constant time) if the record is publicly invalid.
  *   1: if the padding was valid
- *  -1: otherwise. */
+ *  -1: otherwise. 
+ */
 int ssl3_cbc_remove_padding(const SSL* s,
                            SSL3_RECORD *rec,
                            unsigned block_size,
@@ -96,10 +98,11 @@ int ssl3_cbc_remove_padding(const SSL* s,
        padding_length = good & (padding_length+1);
        rec->length -= padding_length;
        rec->type |= padding_length<<8; /* kludge: pass padding length */
-       return (int)((good & 1) | (~good & -1));
+       return constant_time_select_int(good, 1, -1);
        }
 
-/* tls1_cbc_remove_padding removes the CBC padding from the decrypted, TLS, CBC
+/*- 
+ * tls1_cbc_remove_padding removes the CBC padding from the decrypted, TLS, CBC
  * record in |rec| in constant time and returns 1 if the padding is valid and
  * -1 otherwise. It also removes any explicit IV from the start of the record
  * without leaking any timing about whether there was enough space after the
@@ -109,7 +112,8 @@ int ssl3_cbc_remove_padding(const SSL* s,
  * returns:
  *   0: (in non-constant time) if the record is publicly invalid.
  *   1: if the padding was valid
- *  -1: otherwise. */
+ *  -1: otherwise. 
+ */
 int tls1_cbc_remove_padding(const SSL* s,
                            SSL3_RECORD *rec,
                            unsigned block_size,
@@ -186,10 +190,11 @@ int tls1_cbc_remove_padding(const SSL* s,
        rec->length -= padding_length;
        rec->type |= padding_length<<8; /* kludge: pass padding length */
 
-       return (int)((good & 1) | (~good & -1));
+       return constant_time_select_int(good, 1, -1);
        }
 
-/* ssl3_cbc_copy_mac copies |md_size| bytes from the end of |rec| to |out| in
+/*-
+ * ssl3_cbc_copy_mac copies |md_size| bytes from the end of |rec| to |out| in
  * constant time (independent of the concrete value of rec->length, which may
  * vary within a 256-byte window).
  *
@@ -367,7 +372,8 @@ char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
                }
        }
 
-/* ssl3_cbc_digest_record computes the MAC of a decrypted, padded SSLv3/TLS
+/*-
+ * ssl3_cbc_digest_record computes the MAC of a decrypted, padded SSLv3/TLS
  * record.
  *
  *   ctx: the EVP_MD_CTX from which we take the hash function.
@@ -385,7 +391,8 @@ char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
  * On entry: by virtue of having been through one of the remove_padding
  * functions, above, we know that data_plus_mac_size is large enough to contain
  * a padding byte and MAC. (If the padding was invalid, it might contain the
- * padding too. ) */
+ * padding too. ) 
+ */
 void ssl3_cbc_digest_record(
        const EVP_MD_CTX *ctx,
        unsigned char* md_out,
@@ -641,7 +648,7 @@ void ssl3_cbc_digest_record(
                        /* If this is the block containing the end of the
                         * application data, and we are at the offset for the
                         * 0x80 value, then overwrite b with 0x80. */
-                       b = (b&~is_past_c) | (0x80&is_past_c);
+                        b =  constant_time_select_8(is_past_c, 0x80, b);
                        /* If this the the block containing the end of the
                         * application data and we're past the 0x80 value then
                         * just write zero. */
@@ -657,7 +664,8 @@ void ssl3_cbc_digest_record(
                        if (j >= md_block_size - md_length_size)
                                {
                                /* If this is index_b, write a length byte. */
-                               b = (b&~is_block_b) | (is_block_b&length_bytes[j-(md_block_size-md_length_size)]);
+                               b = constant_time_select_8(
+                                       is_block_b, length_bytes[j-(md_block_size-md_length_size)], b);
                                }
                        block[j] = b;
                        }