2 * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
11 #include "../ssl_local.h"
12 #include <openssl/trace.h>
13 #include <openssl/rand.h>
14 #include <openssl/core_names.h>
15 #include "record_local.h"
16 #include "internal/cryptlib.h"
18 static const unsigned char ssl3_pad_1[48] = {
19 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
20 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
21 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
22 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
23 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
24 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36
27 static const unsigned char ssl3_pad_2[48] = {
28 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
29 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
30 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
31 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
32 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
33 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c
37 * Clear the contents of an SSL3_RECORD but retain any memory allocated
39 void SSL3_RECORD_clear(SSL3_RECORD *r, size_t num_recs)
44 for (i = 0; i < num_recs; i++) {
47 memset(&r[i], 0, sizeof(*r));
52 void SSL3_RECORD_release(SSL3_RECORD *r, size_t num_recs)
56 for (i = 0; i < num_recs; i++) {
57 OPENSSL_free(r[i].comp);
62 void SSL3_RECORD_set_seq_num(SSL3_RECORD *r, const unsigned char *seq_num)
64 memcpy(r->seq_num, seq_num, SEQ_NUM_SIZE);
67 uint32_t ossl_get_max_early_data(SSL_CONNECTION *s)
69 uint32_t max_early_data;
70 SSL_SESSION *sess = s->session;
73 * If we are a client then we always use the max_early_data from the
74 * session/psksession. Otherwise we go with the lowest out of the max early
75 * data set in the session and the configured max_early_data.
77 if (!s->server && sess->ext.max_early_data == 0) {
78 if (!ossl_assert(s->psksession != NULL
79 && s->psksession->ext.max_early_data > 0)) {
80 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
87 max_early_data = sess->ext.max_early_data;
88 else if (s->ext.early_data != SSL_EARLY_DATA_ACCEPTED)
89 max_early_data = s->recv_max_early_data;
91 max_early_data = s->recv_max_early_data < sess->ext.max_early_data
92 ? s->recv_max_early_data : sess->ext.max_early_data;
94 return max_early_data;
97 int ossl_early_data_count_ok(SSL_CONNECTION *s, size_t length, size_t overhead,
100 uint32_t max_early_data;
102 max_early_data = ossl_get_max_early_data(s);
104 if (max_early_data == 0) {
105 SSLfatal(s, send ? SSL_AD_INTERNAL_ERROR : SSL_AD_UNEXPECTED_MESSAGE,
106 SSL_R_TOO_MUCH_EARLY_DATA);
110 /* If we are dealing with ciphertext we need to allow for the overhead */
111 max_early_data += overhead;
113 if (s->early_data_count + length > max_early_data) {
114 SSLfatal(s, send ? SSL_AD_INTERNAL_ERROR : SSL_AD_UNEXPECTED_MESSAGE,
115 SSL_R_TOO_MUCH_EARLY_DATA);
118 s->early_data_count += length;
123 int ssl3_do_uncompress(SSL_CONNECTION *ssl, SSL3_RECORD *rr)
125 #ifndef OPENSSL_NO_COMP
128 if (rr->comp == NULL) {
129 rr->comp = (unsigned char *)
130 OPENSSL_malloc(SSL3_RT_MAX_ENCRYPTED_LENGTH);
132 if (rr->comp == NULL)
135 i = COMP_expand_block(ssl->expand, rr->comp,
136 SSL3_RT_MAX_PLAIN_LENGTH, rr->data, (int)rr->length);
146 int ssl3_do_compress(SSL_CONNECTION *sc, SSL3_RECORD *wr)
148 #ifndef OPENSSL_NO_COMP
151 i = COMP_compress_block(sc->compress, wr->data,
152 (int)(wr->length + SSL3_RT_MAX_COMPRESSED_OVERHEAD),
153 wr->input, (int)wr->length);
159 wr->input = wr->data;
165 * ssl3_enc encrypts/decrypts |n_recs| records in |inrecs|. Calls SSLfatal on
166 * internal error, but not otherwise. It is the responsibility of the caller to
167 * report a bad_record_mac
170 * 0: if the record is publicly invalid, or an internal error
171 * 1: Success or Mac-then-encrypt decryption failed (MAC will be randomised)
173 int ssl3_enc(SSL_CONNECTION *s, SSL3_RECORD *inrecs, size_t n_recs, int sending,
174 SSL_MAC_BUF *mac, size_t macsize)
180 const EVP_CIPHER *enc;
185 * We shouldn't ever be called with more than one record in the SSLv3 case
190 ds = s->enc_write_ctx;
191 if (s->enc_write_ctx == NULL)
194 enc = EVP_CIPHER_CTX_get0_cipher(s->enc_write_ctx);
196 if ((s->session == NULL) || (ds == NULL) || (enc == NULL)) {
197 memmove(rec->data, rec->input, rec->length);
198 rec->input = rec->data;
200 int provided = (EVP_CIPHER_get0_provider(enc) != NULL);
203 bs = EVP_CIPHER_CTX_get_block_size(ds);
207 if ((bs != 1) && !provided) {
209 * We only do this for legacy ciphers. Provided ciphers add the
210 * padding on the provider side.
214 /* we need to add 'i-1' padding bytes */
217 * the last of these zero bytes will be overwritten with the
220 memset(&rec->input[rec->length], 0, i);
222 rec->input[l - 1] = (unsigned char)(i - 1);
225 if (EVP_CIPHER_get0_provider(enc) != NULL) {
228 if (!EVP_CipherUpdate(ds, rec->data, &outlen, rec->input,
231 rec->length = outlen;
233 if (EVP_Cipher(ds, rec->data, rec->input, (unsigned int)l) < 1) {
234 /* Shouldn't happen */
235 SSLfatal(s, SSL_AD_BAD_RECORD_MAC, ERR_R_INTERNAL_ERROR);
243 #define MAX_PADDING 256
245 * tls1_enc encrypts/decrypts |n_recs| in |recs|. Calls SSLfatal on internal
246 * error, but not otherwise. It is the responsibility of the caller to report
247 * a bad_record_mac - if appropriate (DTLS just drops the record).
250 * 0: if the record is publicly invalid, or an internal error, or AEAD
251 * decryption failed, or Encrypt-then-mac decryption failed.
252 * 1: Success or Mac-then-encrypt decryption failed (MAC will be randomised)
254 int tls1_enc(SSL_CONNECTION *s, SSL3_RECORD *recs, size_t n_recs, int sending,
255 SSL_MAC_BUF *macs, size_t macsize)
258 size_t reclen[SSL_MAX_PIPELINES];
259 unsigned char buf[SSL_MAX_PIPELINES][EVP_AEAD_TLS1_AAD_LEN];
260 int i, pad = 0, tmpr;
261 size_t bs, ctr, padnum, loop;
262 unsigned char padval;
263 const EVP_CIPHER *enc;
264 int tlstree_enc = (s->mac_flags & SSL_MAC_FLAG_WRITE_MAC_TLSTREE);
267 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
272 if (EVP_MD_CTX_get0_md(s->write_hash)) {
273 int n = EVP_MD_CTX_get_size(s->write_hash);
275 if (!ossl_assert(n >= 0)) {
276 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
280 ds = s->enc_write_ctx;
281 if (s->enc_write_ctx == NULL)
286 enc = EVP_CIPHER_CTX_get0_cipher(s->enc_write_ctx);
287 /* For TLSv1.1 and later explicit IV */
288 if (SSL_USE_EXPLICIT_IV(s)
289 && EVP_CIPHER_get_mode(enc) == EVP_CIPH_CBC_MODE)
290 ivlen = EVP_CIPHER_get_iv_length(enc);
294 for (ctr = 0; ctr < n_recs; ctr++) {
295 if (recs[ctr].data != recs[ctr].input) {
297 * we can't write into the input stream: Can this ever
300 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
302 } else if (RAND_bytes_ex(SSL_CONNECTION_GET_CTX(s)->libctx,
305 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
312 if ((s->session == NULL) || (ds == NULL) || (enc == NULL)) {
313 for (ctr = 0; ctr < n_recs; ctr++) {
314 memmove(recs[ctr].data, recs[ctr].input, recs[ctr].length);
315 recs[ctr].input = recs[ctr].data;
318 int provided = (EVP_CIPHER_get0_provider(enc) != NULL);
320 bs = EVP_CIPHER_get_block_size(EVP_CIPHER_CTX_get0_cipher(ds));
323 if ((EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(ds))
324 & EVP_CIPH_FLAG_PIPELINE) == 0) {
326 * We shouldn't have been called with pipeline data if the
327 * cipher doesn't support pipelining
329 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_PIPELINE_FAILURE);
333 for (ctr = 0; ctr < n_recs; ctr++) {
334 reclen[ctr] = recs[ctr].length;
336 if ((EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(ds))
337 & EVP_CIPH_FLAG_AEAD_CIPHER) != 0) {
340 seq = RECORD_LAYER_get_write_sequence(&s->rlayer);
342 if (SSL_CONNECTION_IS_DTLS(s)) {
343 /* DTLS does not support pipelining */
344 unsigned char dtlsseq[8], *p = dtlsseq;
346 s2n(DTLS_RECORD_LAYER_get_w_epoch(&s->rlayer), p);
347 memcpy(p, &seq[2], 6);
348 memcpy(buf[ctr], dtlsseq, 8);
350 memcpy(buf[ctr], seq, 8);
351 for (i = 7; i >= 0; i--) { /* increment */
358 buf[ctr][8] = recs[ctr].type;
359 buf[ctr][9] = (unsigned char)(s->version >> 8);
360 buf[ctr][10] = (unsigned char)(s->version);
361 buf[ctr][11] = (unsigned char)(recs[ctr].length >> 8);
362 buf[ctr][12] = (unsigned char)(recs[ctr].length & 0xff);
363 pad = EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_AEAD_TLS1_AAD,
364 EVP_AEAD_TLS1_AAD_LEN, buf[ctr]);
366 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
371 recs[ctr].length += pad;
373 } else if ((bs != 1) && !provided) {
375 * We only do this for legacy ciphers. Provided ciphers add the
376 * padding on the provider side.
378 padnum = bs - (reclen[ctr] % bs);
380 /* Add weird padding of up to 256 bytes */
382 if (padnum > MAX_PADDING) {
383 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
386 /* we need to add 'padnum' padding bytes of value padval */
387 padval = (unsigned char)(padnum - 1);
388 for (loop = reclen[ctr]; loop < reclen[ctr] + padnum; loop++)
389 recs[ctr].input[loop] = padval;
390 reclen[ctr] += padnum;
391 recs[ctr].length += padnum;
395 unsigned char *data[SSL_MAX_PIPELINES];
397 /* Set the output buffers */
398 for (ctr = 0; ctr < n_recs; ctr++) {
399 data[ctr] = recs[ctr].data;
401 if (EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_SET_PIPELINE_OUTPUT_BUFS,
402 (int)n_recs, data) <= 0) {
403 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_PIPELINE_FAILURE);
406 /* Set the input buffers */
407 for (ctr = 0; ctr < n_recs; ctr++) {
408 data[ctr] = recs[ctr].input;
410 if (EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_SET_PIPELINE_INPUT_BUFS,
411 (int)n_recs, data) <= 0
412 || EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_SET_PIPELINE_INPUT_LENS,
413 (int)n_recs, reclen) <= 0) {
414 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_PIPELINE_FAILURE);
419 if (!SSL_CONNECTION_IS_DTLS(s) && tlstree_enc) {
421 int decrement_seq = 0;
424 * When sending, seq is incremented after MAC calculation.
425 * So if we are in ETM mode, we use seq 'as is' in the ctrl-function.
426 * Otherwise we have to decrease it in the implementation
428 if (!SSL_WRITE_ETM(s))
431 seq = RECORD_LAYER_get_write_sequence(&s->rlayer);
432 if (EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_TLSTREE, decrement_seq, seq) <= 0) {
433 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
441 /* Provided cipher - we do not support pipelining on this path */
443 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
447 if (!EVP_CipherUpdate(ds, recs[0].data, &outlen, recs[0].input,
448 (unsigned int)reclen[0]))
450 recs[0].length = outlen;
454 tmpr = EVP_Cipher(ds, recs[0].data, recs[0].input,
455 (unsigned int)reclen[0]);
456 if ((EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(ds))
457 & EVP_CIPH_FLAG_CUSTOM_CIPHER) != 0
460 /* AEAD can fail to verify MAC */
468 int n_ssl3_mac(SSL_CONNECTION *sc, SSL3_RECORD *rec, unsigned char *md,
471 unsigned char *mac_sec, *seq;
472 const EVP_MD_CTX *hash;
473 unsigned char *p, rec_char;
477 unsigned int md_size_u;
481 * All read record layer operations should have been moved to the new
486 mac_sec = &(sc->s3.write_mac_secret[0]);
487 seq = RECORD_LAYER_get_write_sequence(&sc->rlayer);
488 hash = sc->write_hash;
490 t = EVP_MD_CTX_get_size(hash);
494 npad = (48 / md_size) * md_size;
496 /* Chop the digest off the end :-) */
497 md_ctx = EVP_MD_CTX_new();
502 rec_char = rec->type;
505 if (EVP_MD_CTX_copy_ex(md_ctx, hash) <= 0
506 || EVP_DigestUpdate(md_ctx, mac_sec, md_size) <= 0
507 || EVP_DigestUpdate(md_ctx, ssl3_pad_1, npad) <= 0
508 || EVP_DigestUpdate(md_ctx, seq, 8) <= 0
509 || EVP_DigestUpdate(md_ctx, &rec_char, 1) <= 0
510 || EVP_DigestUpdate(md_ctx, md, 2) <= 0
511 || EVP_DigestUpdate(md_ctx, rec->input, rec->length) <= 0
512 || EVP_DigestFinal_ex(md_ctx, md, NULL) <= 0
513 || EVP_MD_CTX_copy_ex(md_ctx, hash) <= 0
514 || EVP_DigestUpdate(md_ctx, mac_sec, md_size) <= 0
515 || EVP_DigestUpdate(md_ctx, ssl3_pad_2, npad) <= 0
516 || EVP_DigestUpdate(md_ctx, md, md_size) <= 0
517 || EVP_DigestFinal_ex(md_ctx, md, &md_size_u) <= 0) {
518 EVP_MD_CTX_free(md_ctx);
522 EVP_MD_CTX_free(md_ctx);
524 ssl3_record_sequence_update(seq);
528 int tls1_mac_old(SSL_CONNECTION *sc, SSL3_RECORD *rec, unsigned char *md,
535 EVP_MD_CTX *hmac = NULL, *mac_ctx;
536 unsigned char header[13];
537 int stream_mac = (sc->mac_flags & SSL_MAC_FLAG_WRITE_MAC_STREAM);
538 int tlstree_mac = (sc->mac_flags & SSL_MAC_FLAG_WRITE_MAC_TLSTREE);
543 * All read record layer calls should have been moved to the new record
548 seq = RECORD_LAYER_get_write_sequence(&sc->rlayer);
549 hash = sc->write_hash;
551 t = EVP_MD_CTX_get_size(hash);
552 if (!ossl_assert(t >= 0))
556 /* I should fix this up TLS TLS TLS TLS TLS XXXXXXXX */
560 hmac = EVP_MD_CTX_new();
561 if (hmac == NULL || !EVP_MD_CTX_copy(hmac, hash)) {
567 if (!SSL_CONNECTION_IS_DTLS(sc) && tlstree_mac
568 && EVP_MD_CTX_ctrl(mac_ctx, EVP_MD_CTRL_TLSTREE, 0, seq) <= 0) {
572 if (SSL_CONNECTION_IS_DTLS(sc)) {
573 unsigned char dtlsseq[8], *p = dtlsseq;
575 s2n(DTLS_RECORD_LAYER_get_w_epoch(&sc->rlayer), p);
576 memcpy(p, &seq[2], 6);
578 memcpy(header, dtlsseq, 8);
580 memcpy(header, seq, 8);
582 header[8] = rec->type;
583 header[9] = (unsigned char)(sc->version >> 8);
584 header[10] = (unsigned char)(sc->version);
585 header[11] = (unsigned char)(rec->length >> 8);
586 header[12] = (unsigned char)(rec->length & 0xff);
588 if (EVP_DigestSignUpdate(mac_ctx, header, sizeof(header)) <= 0
589 || EVP_DigestSignUpdate(mac_ctx, rec->input, rec->length) <= 0
590 || EVP_DigestSignFinal(mac_ctx, md, &md_size) <= 0) {
594 OSSL_TRACE_BEGIN(TLS) {
595 BIO_printf(trc_out, "seq:\n");
596 BIO_dump_indent(trc_out, seq, 8, 4);
597 BIO_printf(trc_out, "rec:\n");
598 BIO_dump_indent(trc_out, rec->data, rec->length, 4);
599 } OSSL_TRACE_END(TLS);
601 if (!SSL_CONNECTION_IS_DTLS(sc)) {
602 for (i = 7; i >= 0; i--) {
608 OSSL_TRACE_BEGIN(TLS) {
609 BIO_printf(trc_out, "md:\n");
610 BIO_dump_indent(trc_out, md, md_size, 4);
611 } OSSL_TRACE_END(TLS);
614 EVP_MD_CTX_free(hmac);