1 /* ssl/record/ssl3_record.c */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
58 /* ====================================================================
59 * Copyright (c) 1998-2015 The OpenSSL Project. All rights reserved.
61 * Redistribution and use in source and binary forms, with or without
62 * modification, are permitted provided that the following conditions
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
68 * 2. Redistributions in binary form must reproduce the above copyright
69 * notice, this list of conditions and the following disclaimer in
70 * the documentation and/or other materials provided with the
73 * 3. All advertising materials mentioning features or use of this
74 * software must display the following acknowledgment:
75 * "This product includes software developed by the OpenSSL Project
76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 * endorse or promote products derived from this software without
80 * prior written permission. For written permission, please contact
81 * openssl-core@openssl.org.
83 * 5. Products derived from this software may not be called "OpenSSL"
84 * nor may "OpenSSL" appear in their names without prior written
85 * permission of the OpenSSL Project.
87 * 6. Redistributions of any form whatsoever must retain the following
89 * "This product includes software developed by the OpenSSL Project
90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 * OF THE POSSIBILITY OF SUCH DAMAGE.
104 * ====================================================================
106 * This product includes cryptographic software written by Eric Young
107 * (eay@cryptsoft.com). This product includes software written by Tim
108 * Hudson (tjh@cryptsoft.com).
112 #include "../ssl_locl.h"
113 #include "internal/constant_time_locl.h"
114 #include <openssl/rand.h>
115 #include "record_locl.h"
117 static const unsigned char ssl3_pad_1[48] = {
118 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
119 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
120 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
121 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
122 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
123 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36
126 static const unsigned char ssl3_pad_2[48] = {
127 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
128 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
129 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
130 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
131 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
132 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c
135 void SSL3_RECORD_clear(SSL3_RECORD *r)
137 memset(r->seq_num, 0, sizeof(r->seq_num));
140 void SSL3_RECORD_release(SSL3_RECORD *r)
142 OPENSSL_free(r->comp);
146 int SSL3_RECORD_setup(SSL3_RECORD *r)
149 r->comp = (unsigned char *)
150 OPENSSL_malloc(SSL3_RT_MAX_ENCRYPTED_LENGTH);
156 void SSL3_RECORD_set_seq_num(SSL3_RECORD *r, const unsigned char *seq_num)
158 memcpy(r->seq_num, seq_num, SEQ_NUM_SIZE);
162 * MAX_EMPTY_RECORDS defines the number of consecutive, empty records that
163 * will be processed per call to ssl3_get_record. Without this limit an
164 * attacker could send empty records at a faster rate than we can process and
165 * cause ssl3_get_record to loop forever.
167 #define MAX_EMPTY_RECORDS 32
169 #define SSL2_RT_HEADER_LENGTH 2
171 * Call this to get a new input record.
172 * It will return <= 0 if more data is needed, normally due to an error
173 * or non-blocking IO.
174 * When it finishes, one packet has been decoded and can be found in
175 * ssl->s3->rrec.type - is the type of record
176 * ssl->s3->rrec.data, - data
177 * ssl->s3->rrec.length, - number of bytes
179 /* used only by ssl3_read_bytes */
180 int ssl3_get_record(SSL *s)
182 int ssl_major, ssl_minor, al;
183 int enc_err, n, i, ret = -1;
187 unsigned char md[EVP_MAX_MD_SIZE];
191 unsigned empty_record_count = 0;
193 rr = RECORD_LAYER_get_rrec(&s->rlayer);
196 if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)
197 extra = SSL3_RT_MAX_EXTRA;
200 if (extra && !s->s3->init_extra) {
202 * An application error: SLS_OP_MICROSOFT_BIG_SSLV3_BUFFER set after
203 * ssl3_setup_buffers() was done
205 SSLerr(SSL_F_SSL3_GET_RECORD, ERR_R_INTERNAL_ERROR);
210 /* check if we have the header */
211 if ((RECORD_LAYER_get_rstate(&s->rlayer) != SSL_ST_READ_BODY) ||
212 (RECORD_LAYER_get_packet_length(&s->rlayer) < SSL3_RT_HEADER_LENGTH)) {
213 n = ssl3_read_n(s, SSL3_RT_HEADER_LENGTH,
214 SSL3_BUFFER_get_len(&s->rlayer.rbuf), 0);
216 return (n); /* error or non-blocking */
217 RECORD_LAYER_set_rstate(&s->rlayer, SSL_ST_READ_BODY);
219 p = RECORD_LAYER_get_packet(&s->rlayer);
222 * Check whether this is a regular record or an SSLv2 style record. The
223 * latter is only used in an initial ClientHello for old clients. We
224 * check s->read_hash and s->enc_read_ctx to ensure this does not apply
225 * during renegotiation
227 if (s->first_packet && s->server && !s->read_hash && !s->enc_read_ctx
228 && (p[0] & 0x80) && (p[2] == SSL2_MT_CLIENT_HELLO)) {
229 /* SSLv2 style record */
230 rr->type = SSL3_RT_HANDSHAKE;
231 rr->rec_version = SSL2_VERSION;
233 rr->length = ((p[0] & 0x7f) << 8) | p[1];
235 if (rr->length > SSL3_BUFFER_get_len(&s->rlayer.rbuf)
236 - SSL2_RT_HEADER_LENGTH) {
237 al = SSL_AD_RECORD_OVERFLOW;
238 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_PACKET_LENGTH_TOO_LONG);
242 if (rr->length < MIN_SSL2_RECORD_LEN) {
243 al = SSL_AD_HANDSHAKE_FAILURE;
244 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_LENGTH_TOO_SHORT);
248 /* SSLv3+ style record */
250 s->msg_callback(0, 0, SSL3_RT_HEADER, p, 5, s,
251 s->msg_callback_arg);
253 /* Pull apart the header into the SSL3_RECORD */
257 version = (ssl_major << 8) | ssl_minor;
258 rr->rec_version = version;
261 /* Lets check version */
262 if (!s->first_packet && version != s->version) {
263 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_WRONG_VERSION_NUMBER);
264 if ((s->version & 0xFF00) == (version & 0xFF00)
265 && !s->enc_write_ctx && !s->write_hash)
267 * Send back error using their minor version number :-)
269 s->version = (unsigned short)version;
270 al = SSL_AD_PROTOCOL_VERSION;
274 if ((version >> 8) != SSL3_VERSION_MAJOR) {
275 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_WRONG_VERSION_NUMBER);
280 SSL3_BUFFER_get_len(&s->rlayer.rbuf)
281 - SSL3_RT_HEADER_LENGTH) {
282 al = SSL_AD_RECORD_OVERFLOW;
283 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_PACKET_LENGTH_TOO_LONG);
288 /* now s->rlayer.rstate == SSL_ST_READ_BODY */
292 * s->rlayer.rstate == SSL_ST_READ_BODY, get and decode the data.
293 * Calculate how much more data we need to read for the rest of the record
295 if (rr->rec_version == SSL2_VERSION) {
296 i = rr->length + SSL2_RT_HEADER_LENGTH - SSL3_RT_HEADER_LENGTH;
301 /* now s->packet_length == SSL3_RT_HEADER_LENGTH */
303 n = ssl3_read_n(s, i, i, 1);
305 return (n); /* error or non-blocking io */
308 /* set state for later operations */
309 RECORD_LAYER_set_rstate(&s->rlayer, SSL_ST_READ_HEADER);
312 * At this point, s->packet_length == SSL3_RT_HEADER_LENGTH + rr->length,
313 * or s->packet_length == SSL2_RT_HEADER_LENGTH + rr->length
314 * and we have that many bytes in s->packet
316 if(rr->rec_version == SSL2_VERSION) {
317 rr->input = &(RECORD_LAYER_get_packet(&s->rlayer)[SSL2_RT_HEADER_LENGTH]);
319 rr->input = &(RECORD_LAYER_get_packet(&s->rlayer)[SSL3_RT_HEADER_LENGTH]);
323 * ok, we can now read from 's->packet' data into 'rr' rr->input points
324 * at rr->length bytes, which need to be copied into rr->data by either
325 * the decryption or by the decompression When the data is 'copied' into
326 * the rr->data buffer, rr->input will be pointed at the new buffer
330 * We now have - encrypted [ MAC [ compressed [ plain ] ] ] rr->length
331 * bytes of encrypted compressed stuff.
334 /* check is not needed I believe */
335 if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH + extra) {
336 al = SSL_AD_RECORD_OVERFLOW;
337 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
341 /* decrypt in place in 'rr->input' */
342 rr->data = rr->input;
343 rr->orig_len = rr->length;
345 * If in encrypt-then-mac mode calculate mac from encrypted record. All
346 * the details below are public so no timing details can leak.
348 if (SSL_USE_ETM(s) && s->read_hash) {
350 mac_size = EVP_MD_CTX_size(s->read_hash);
351 OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);
352 if (rr->length < mac_size) {
353 al = SSL_AD_DECODE_ERROR;
354 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_LENGTH_TOO_SHORT);
357 rr->length -= mac_size;
358 mac = rr->data + rr->length;
359 i = s->method->ssl3_enc->mac(s, md, 0 /* not send */ );
360 if (i < 0 || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0) {
361 al = SSL_AD_BAD_RECORD_MAC;
362 SSLerr(SSL_F_SSL3_GET_RECORD,
363 SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
368 enc_err = s->method->ssl3_enc->enc(s, 0);
371 * 0: (in non-constant time) if the record is publically invalid.
372 * 1: if the padding is valid
373 * -1: if the padding is invalid
376 al = SSL_AD_DECRYPTION_FAILED;
377 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
381 printf("dec %d\n", rr->length);
384 for (z = 0; z < rr->length; z++)
385 printf("%02X%c", rr->data[z], ((z + 1) % 16) ? ' ' : '\n');
390 /* r->length is now the compressed data plus mac */
391 if ((sess != NULL) &&
392 (s->enc_read_ctx != NULL) &&
393 (EVP_MD_CTX_md(s->read_hash) != NULL) && !SSL_USE_ETM(s)) {
394 /* s->read_hash != NULL => mac_size != -1 */
395 unsigned char *mac = NULL;
396 unsigned char mac_tmp[EVP_MAX_MD_SIZE];
397 mac_size = EVP_MD_CTX_size(s->read_hash);
398 OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);
401 * orig_len is the length of the record before any padding was
402 * removed. This is public information, as is the MAC in use,
403 * therefore we can safely process the record in a different amount
404 * of time if it's too short to possibly contain a MAC.
406 if (rr->orig_len < mac_size ||
407 /* CBC records must have a padding length byte too. */
408 (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
409 rr->orig_len < mac_size + 1)) {
410 al = SSL_AD_DECODE_ERROR;
411 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_LENGTH_TOO_SHORT);
415 if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE) {
417 * We update the length so that the TLS header bytes can be
418 * constructed correctly but we need to extract the MAC in
419 * constant time from within the record, without leaking the
420 * contents of the padding bytes.
423 ssl3_cbc_copy_mac(mac_tmp, rr, mac_size);
424 rr->length -= mac_size;
427 * In this case there's no padding, so |rec->orig_len| equals
428 * |rec->length| and we checked that there's enough bytes for
431 rr->length -= mac_size;
432 mac = &rr->data[rr->length];
435 i = s->method->ssl3_enc->mac(s, md, 0 /* not send */ );
436 if (i < 0 || mac == NULL
437 || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0)
439 if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH + extra + mac_size)
445 * A separate 'decryption_failed' alert was introduced with TLS 1.0,
446 * SSL 3.0 only has 'bad_record_mac'. But unless a decryption
447 * failure is directly visible from the ciphertext anyway, we should
448 * not reveal which kind of error occurred -- this might become
449 * visible to an attacker (e.g. via a logfile)
451 al = SSL_AD_BAD_RECORD_MAC;
452 SSLerr(SSL_F_SSL3_GET_RECORD,
453 SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
457 /* r->length is now just compressed */
458 if (s->expand != NULL) {
459 if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH + extra) {
460 al = SSL_AD_RECORD_OVERFLOW;
461 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_COMPRESSED_LENGTH_TOO_LONG);
464 if (!ssl3_do_uncompress(s)) {
465 al = SSL_AD_DECOMPRESSION_FAILURE;
466 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BAD_DECOMPRESSION);
471 if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH + extra) {
472 al = SSL_AD_RECORD_OVERFLOW;
473 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_DATA_LENGTH_TOO_LONG);
479 * So at this point the following is true
480 * ssl->s3->rrec.type is the type of record
481 * ssl->s3->rrec.length == number of bytes in record
482 * ssl->s3->rrec.off == offset to first valid byte
483 * ssl->s3->rrec.data == where to take bytes from, increment
487 /* we have pulled in a full packet so zero things */
488 RECORD_LAYER_reset_packet_length(&s->rlayer);
490 /* just read a 0 length packet */
491 if (rr->length == 0) {
492 empty_record_count++;
493 if (empty_record_count > MAX_EMPTY_RECORDS) {
494 al = SSL_AD_UNEXPECTED_MESSAGE;
495 SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_RECORD_TOO_SMALL);
504 ssl3_send_alert(s, SSL3_AL_FATAL, al);
509 int ssl3_do_uncompress(SSL *ssl)
511 #ifndef OPENSSL_NO_COMP
515 rr = RECORD_LAYER_get_rrec(&ssl->rlayer);
516 i = COMP_expand_block(ssl->expand, rr->comp,
517 SSL3_RT_MAX_PLAIN_LENGTH, rr->data,
528 int ssl3_do_compress(SSL *ssl)
530 #ifndef OPENSSL_NO_COMP
534 wr = RECORD_LAYER_get_wrec(&ssl->rlayer);
535 i = COMP_compress_block(ssl->compress, wr->data,
536 SSL3_RT_MAX_COMPRESSED_LENGTH,
537 wr->input, (int)wr->length);
543 wr->input = wr->data;
549 * ssl3_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
552 * 0: (in non-constant time) if the record is publically invalid (i.e. too
554 * 1: if the record's padding is valid / the encryption was successful.
555 * -1: if the record's padding is invalid or, if sending, an internal error
558 int ssl3_enc(SSL *s, int send)
563 int bs, i, mac_size = 0;
564 const EVP_CIPHER *enc;
567 ds = s->enc_write_ctx;
568 rec = RECORD_LAYER_get_wrec(&s->rlayer);
569 if (s->enc_write_ctx == NULL)
572 enc = EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
574 ds = s->enc_read_ctx;
575 rec = RECORD_LAYER_get_rrec(&s->rlayer);
576 if (s->enc_read_ctx == NULL)
579 enc = EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
582 if ((s->session == NULL) || (ds == NULL) || (enc == NULL)) {
583 memmove(rec->data, rec->input, rec->length);
584 rec->input = rec->data;
587 bs = EVP_CIPHER_block_size(ds->cipher);
591 if ((bs != 1) && send) {
592 i = bs - ((int)l % bs);
594 /* we need to add 'i-1' padding bytes */
597 * the last of these zero bytes will be overwritten with the
600 memset(&rec->input[rec->length], 0, i);
602 rec->input[l - 1] = (i - 1);
606 if (l == 0 || l % bs != 0)
608 /* otherwise, rec->length >= bs */
611 if (EVP_Cipher(ds, rec->data, rec->input, l) < 1)
614 if (EVP_MD_CTX_md(s->read_hash) != NULL)
615 mac_size = EVP_MD_CTX_size(s->read_hash);
616 if ((bs != 1) && !send)
617 return ssl3_cbc_remove_padding(s, rec, bs, mac_size);
623 * tls1_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
626 * 0: (in non-constant time) if the record is publically invalid (i.e. too
628 * 1: if the record's padding is valid / the encryption was successful.
629 * -1: if the record's padding/AEAD-authenticator is invalid or, if sending,
630 * an internal error occurred.
632 int tls1_enc(SSL *s, int send)
637 int bs, i, j, k, pad = 0, ret, mac_size = 0;
638 const EVP_CIPHER *enc;
641 if (EVP_MD_CTX_md(s->write_hash)) {
642 int n = EVP_MD_CTX_size(s->write_hash);
643 OPENSSL_assert(n >= 0);
645 ds = s->enc_write_ctx;
646 rec = RECORD_LAYER_get_wrec(&s->rlayer);
647 if (s->enc_write_ctx == NULL)
651 enc = EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
652 /* For TLSv1.1 and later explicit IV */
653 if (SSL_USE_EXPLICIT_IV(s)
654 && EVP_CIPHER_mode(enc) == EVP_CIPH_CBC_MODE)
655 ivlen = EVP_CIPHER_iv_length(enc);
659 if (rec->data != rec->input)
661 * we can't write into the input stream: Can this ever
665 "%s:%d: rec->data != rec->input\n",
667 else if (RAND_bytes(rec->input, ivlen) <= 0)
672 if (EVP_MD_CTX_md(s->read_hash)) {
673 int n = EVP_MD_CTX_size(s->read_hash);
674 OPENSSL_assert(n >= 0);
676 ds = s->enc_read_ctx;
677 rec = RECORD_LAYER_get_rrec(&s->rlayer);
678 if (s->enc_read_ctx == NULL)
681 enc = EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
684 if ((s->session == NULL) || (ds == NULL) || (enc == NULL)) {
685 memmove(rec->data, rec->input, rec->length);
686 rec->input = rec->data;
690 bs = EVP_CIPHER_block_size(ds->cipher);
692 if (EVP_CIPHER_flags(ds->cipher) & EVP_CIPH_FLAG_AEAD_CIPHER) {
693 unsigned char buf[EVP_AEAD_TLS1_AAD_LEN], *seq;
695 seq = send ? RECORD_LAYER_get_write_sequence(&s->rlayer)
696 : RECORD_LAYER_get_read_sequence(&s->rlayer);
698 if (SSL_IS_DTLS(s)) {
699 unsigned char dtlsseq[9], *p = dtlsseq;
701 s2n(send ? DTLS_RECORD_LAYER_get_w_epoch(&s->rlayer) :
702 DTLS_RECORD_LAYER_get_r_epoch(&s->rlayer), p);
703 memcpy(p, &seq[2], 6);
704 memcpy(buf, dtlsseq, 8);
707 for (i = 7; i >= 0; i--) { /* increment */
715 buf[9] = (unsigned char)(s->version >> 8);
716 buf[10] = (unsigned char)(s->version);
717 buf[11] = rec->length >> 8;
718 buf[12] = rec->length & 0xff;
719 pad = EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_AEAD_TLS1_AAD,
720 EVP_AEAD_TLS1_AAD_LEN, buf);
727 } else if ((bs != 1) && send) {
728 i = bs - ((int)l % bs);
730 /* Add weird padding of upto 256 bytes */
732 /* we need to add 'i' padding bytes of value j */
734 if (s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) {
735 if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
738 for (k = (int)l; k < (int)(l + i); k++)
745 if (l == 0 || l % bs != 0)
749 i = EVP_Cipher(ds, rec->data, rec->input, l);
750 if ((EVP_CIPHER_flags(ds->cipher) & EVP_CIPH_FLAG_CUSTOM_CIPHER)
753 return -1; /* AEAD can fail to verify MAC */
754 if (EVP_CIPHER_mode(enc) == EVP_CIPH_GCM_MODE && !send) {
755 rec->data += EVP_GCM_TLS_EXPLICIT_IV_LEN;
756 rec->input += EVP_GCM_TLS_EXPLICIT_IV_LEN;
757 rec->length -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
761 if (!SSL_USE_ETM(s) && EVP_MD_CTX_md(s->read_hash) != NULL)
762 mac_size = EVP_MD_CTX_size(s->read_hash);
763 if ((bs != 1) && !send)
764 ret = tls1_cbc_remove_padding(s, rec, bs, mac_size);
771 int n_ssl3_mac(SSL *ssl, unsigned char *md, int send)
774 unsigned char *mac_sec, *seq;
776 const EVP_MD_CTX *hash;
777 unsigned char *p, rec_char;
783 rec = RECORD_LAYER_get_wrec(&ssl->rlayer);
784 mac_sec = &(ssl->s3->write_mac_secret[0]);
785 seq = RECORD_LAYER_get_write_sequence(&ssl->rlayer);
786 hash = ssl->write_hash;
788 rec = RECORD_LAYER_get_rrec(&ssl->rlayer);
789 mac_sec = &(ssl->s3->read_mac_secret[0]);
790 seq = RECORD_LAYER_get_read_sequence(&ssl->rlayer);
791 hash = ssl->read_hash;
794 t = EVP_MD_CTX_size(hash);
798 npad = (48 / md_size) * md_size;
801 EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
802 ssl3_cbc_record_digest_supported(hash)) {
804 * This is a CBC-encrypted record. We must avoid leaking any
805 * timing-side channel information about how many blocks of data we
806 * are hashing because that gives an attacker a timing-oracle.
810 * npad is, at most, 48 bytes and that's with MD5:
811 * 16 + 48 + 8 (sequence bytes) + 1 + 2 = 75.
813 * With SHA-1 (the largest hash speced for SSLv3) the hash size
814 * goes up 4, but npad goes down by 8, resulting in a smaller
817 unsigned char header[75];
819 memcpy(header + j, mac_sec, md_size);
821 memcpy(header + j, ssl3_pad_1, npad);
823 memcpy(header + j, seq, 8);
825 header[j++] = rec->type;
826 header[j++] = rec->length >> 8;
827 header[j++] = rec->length & 0xff;
829 /* Final param == is SSLv3 */
830 ssl3_cbc_digest_record(hash,
833 rec->length + md_size, rec->orig_len,
834 mac_sec, md_size, 1);
836 unsigned int md_size_u;
837 /* Chop the digest off the end :-) */
838 EVP_MD_CTX_init(&md_ctx);
840 EVP_MD_CTX_copy_ex(&md_ctx, hash);
841 EVP_DigestUpdate(&md_ctx, mac_sec, md_size);
842 EVP_DigestUpdate(&md_ctx, ssl3_pad_1, npad);
843 EVP_DigestUpdate(&md_ctx, seq, 8);
844 rec_char = rec->type;
845 EVP_DigestUpdate(&md_ctx, &rec_char, 1);
848 EVP_DigestUpdate(&md_ctx, md, 2);
849 EVP_DigestUpdate(&md_ctx, rec->input, rec->length);
850 EVP_DigestFinal_ex(&md_ctx, md, NULL);
852 EVP_MD_CTX_copy_ex(&md_ctx, hash);
853 EVP_DigestUpdate(&md_ctx, mac_sec, md_size);
854 EVP_DigestUpdate(&md_ctx, ssl3_pad_2, npad);
855 EVP_DigestUpdate(&md_ctx, md, md_size);
856 EVP_DigestFinal_ex(&md_ctx, md, &md_size_u);
859 EVP_MD_CTX_cleanup(&md_ctx);
862 ssl3_record_sequence_update(seq);
866 int tls1_mac(SSL *ssl, unsigned char *md, int send)
873 EVP_MD_CTX hmac, *mac_ctx;
874 unsigned char header[13];
875 int stream_mac = (send ? (ssl->mac_flags & SSL_MAC_FLAG_WRITE_MAC_STREAM)
876 : (ssl->mac_flags & SSL_MAC_FLAG_READ_MAC_STREAM));
880 rec = RECORD_LAYER_get_wrec(&ssl->rlayer);
881 seq = RECORD_LAYER_get_write_sequence(&ssl->rlayer);
882 hash = ssl->write_hash;
884 rec = RECORD_LAYER_get_rrec(&ssl->rlayer);
885 seq = RECORD_LAYER_get_read_sequence(&ssl->rlayer);
886 hash = ssl->read_hash;
889 t = EVP_MD_CTX_size(hash);
890 OPENSSL_assert(t >= 0);
893 /* I should fix this up TLS TLS TLS TLS TLS XXXXXXXX */
897 if (!EVP_MD_CTX_copy(&hmac, hash))
902 if (SSL_IS_DTLS(ssl)) {
903 unsigned char dtlsseq[8], *p = dtlsseq;
905 s2n(send ? DTLS_RECORD_LAYER_get_w_epoch(&ssl->rlayer) :
906 DTLS_RECORD_LAYER_get_r_epoch(&ssl->rlayer), p);
907 memcpy(p, &seq[2], 6);
909 memcpy(header, dtlsseq, 8);
911 memcpy(header, seq, 8);
913 header[8] = rec->type;
914 header[9] = (unsigned char)(ssl->version >> 8);
915 header[10] = (unsigned char)(ssl->version);
916 header[11] = (rec->length) >> 8;
917 header[12] = (rec->length) & 0xff;
919 if (!send && !SSL_USE_ETM(ssl) &&
920 EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
921 ssl3_cbc_record_digest_supported(mac_ctx)) {
923 * This is a CBC-encrypted record. We must avoid leaking any
924 * timing-side channel information about how many blocks of data we
925 * are hashing because that gives an attacker a timing-oracle.
927 /* Final param == not SSLv3 */
928 ssl3_cbc_digest_record(mac_ctx,
931 rec->length + md_size, rec->orig_len,
932 ssl->s3->read_mac_secret,
933 ssl->s3->read_mac_secret_size, 0);
935 EVP_DigestSignUpdate(mac_ctx, header, sizeof(header));
936 EVP_DigestSignUpdate(mac_ctx, rec->input, rec->length);
937 t = EVP_DigestSignFinal(mac_ctx, md, &md_size);
938 OPENSSL_assert(t > 0);
939 if (!send && !SSL_USE_ETM(ssl) && FIPS_mode())
940 tls_fips_digest_extra(ssl->enc_read_ctx,
942 rec->length, rec->orig_len);
946 EVP_MD_CTX_cleanup(&hmac);
948 fprintf(stderr, "seq=");
951 for (z = 0; z < 8; z++)
952 fprintf(stderr, "%02X ", seq[z]);
953 fprintf(stderr, "\n");
955 fprintf(stderr, "rec=");
958 for (z = 0; z < rec->length; z++)
959 fprintf(stderr, "%02X ", rec->data[z]);
960 fprintf(stderr, "\n");
964 if (!SSL_IS_DTLS(ssl)) {
965 for (i = 7; i >= 0; i--) {
974 for (z = 0; z < md_size; z++)
975 fprintf(stderr, "%02X ", md[z]);
976 fprintf(stderr, "\n");
983 * ssl3_cbc_remove_padding removes padding from the decrypted, SSLv3, CBC
984 * record in |rec| by updating |rec->length| in constant time.
986 * block_size: the block size of the cipher used to encrypt the record.
988 * 0: (in non-constant time) if the record is publicly invalid.
989 * 1: if the padding was valid
992 int ssl3_cbc_remove_padding(const SSL *s,
994 unsigned block_size, unsigned mac_size)
996 unsigned padding_length, good;
997 const unsigned overhead = 1 /* padding length byte */ + mac_size;
1000 * These lengths are all public so we can test them in non-constant time.
1002 if (overhead > rec->length)
1005 padding_length = rec->data[rec->length - 1];
1006 good = constant_time_ge(rec->length, padding_length + overhead);
1007 /* SSLv3 requires that the padding is minimal. */
1008 good &= constant_time_ge(block_size, padding_length + 1);
1009 rec->length -= good & (padding_length + 1);
1010 return constant_time_select_int(good, 1, -1);
1014 * tls1_cbc_remove_padding removes the CBC padding from the decrypted, TLS, CBC
1015 * record in |rec| in constant time and returns 1 if the padding is valid and
1016 * -1 otherwise. It also removes any explicit IV from the start of the record
1017 * without leaking any timing about whether there was enough space after the
1018 * padding was removed.
1020 * block_size: the block size of the cipher used to encrypt the record.
1022 * 0: (in non-constant time) if the record is publicly invalid.
1023 * 1: if the padding was valid
1026 int tls1_cbc_remove_padding(const SSL *s,
1028 unsigned block_size, unsigned mac_size)
1030 unsigned padding_length, good, to_check, i;
1031 const unsigned overhead = 1 /* padding length byte */ + mac_size;
1032 /* Check if version requires explicit IV */
1033 if (SSL_USE_EXPLICIT_IV(s)) {
1035 * These lengths are all public so we can test them in non-constant
1038 if (overhead + block_size > rec->length)
1040 /* We can now safely skip explicit IV */
1041 rec->data += block_size;
1042 rec->input += block_size;
1043 rec->length -= block_size;
1044 rec->orig_len -= block_size;
1045 } else if (overhead > rec->length)
1048 padding_length = rec->data[rec->length - 1];
1051 * NB: if compression is in operation the first packet may not be of even
1052 * length so the padding bug check cannot be performed. This bug
1053 * workaround has been around since SSLeay so hopefully it is either
1054 * fixed now or no buggy implementation supports compression [steve]
1056 if ((s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand) {
1057 /* First packet is even in size, so check */
1058 if ((memcmp(RECORD_LAYER_get_read_sequence(&s->rlayer),
1059 "\0\0\0\0\0\0\0\0", 8) == 0) &&
1060 !(padding_length & 1)) {
1061 s->s3->flags |= TLS1_FLAGS_TLS_PADDING_BUG;
1063 if ((s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG) && padding_length > 0) {
1068 if (EVP_CIPHER_flags(s->enc_read_ctx->cipher) & EVP_CIPH_FLAG_AEAD_CIPHER) {
1069 /* padding is already verified */
1070 rec->length -= padding_length + 1;
1074 good = constant_time_ge(rec->length, overhead + padding_length);
1076 * The padding consists of a length byte at the end of the record and
1077 * then that many bytes of padding, all with the same value as the length
1078 * byte. Thus, with the length byte included, there are i+1 bytes of
1079 * padding. We can't check just |padding_length+1| bytes because that
1080 * leaks decrypted information. Therefore we always have to check the
1081 * maximum amount of padding possible. (Again, the length of the record
1082 * is public information so we can use it.)
1084 to_check = 255; /* maximum amount of padding. */
1085 if (to_check > rec->length - 1)
1086 to_check = rec->length - 1;
1088 for (i = 0; i < to_check; i++) {
1089 unsigned char mask = constant_time_ge_8(padding_length, i);
1090 unsigned char b = rec->data[rec->length - 1 - i];
1092 * The final |padding_length+1| bytes should all have the value
1093 * |padding_length|. Therefore the XOR should be zero.
1095 good &= ~(mask & (padding_length ^ b));
1099 * If any of the final |padding_length+1| bytes had the wrong value, one
1100 * or more of the lower eight bits of |good| will be cleared.
1102 good = constant_time_eq(0xff, good & 0xff);
1103 rec->length -= good & (padding_length + 1);
1105 return constant_time_select_int(good, 1, -1);
1109 * ssl3_cbc_copy_mac copies |md_size| bytes from the end of |rec| to |out| in
1110 * constant time (independent of the concrete value of rec->length, which may
1111 * vary within a 256-byte window).
1113 * ssl3_cbc_remove_padding or tls1_cbc_remove_padding must be called prior to
1117 * rec->orig_len >= md_size
1118 * md_size <= EVP_MAX_MD_SIZE
1120 * If CBC_MAC_ROTATE_IN_PLACE is defined then the rotation is performed with
1121 * variable accesses in a 64-byte-aligned buffer. Assuming that this fits into
1122 * a single or pair of cache-lines, then the variable memory accesses don't
1123 * actually affect the timing. CPUs with smaller cache-lines [if any] are
1124 * not multi-core and are not considered vulnerable to cache-timing attacks.
1126 #define CBC_MAC_ROTATE_IN_PLACE
1128 void ssl3_cbc_copy_mac(unsigned char *out,
1129 const SSL3_RECORD *rec, unsigned md_size)
1131 #if defined(CBC_MAC_ROTATE_IN_PLACE)
1132 unsigned char rotated_mac_buf[64 + EVP_MAX_MD_SIZE];
1133 unsigned char *rotated_mac;
1135 unsigned char rotated_mac[EVP_MAX_MD_SIZE];
1139 * mac_end is the index of |rec->data| just after the end of the MAC.
1141 unsigned mac_end = rec->length;
1142 unsigned mac_start = mac_end - md_size;
1144 * scan_start contains the number of bytes that we can ignore because the
1145 * MAC's position can only vary by 255 bytes.
1147 unsigned scan_start = 0;
1149 unsigned div_spoiler;
1150 unsigned rotate_offset;
1152 OPENSSL_assert(rec->orig_len >= md_size);
1153 OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE);
1155 #if defined(CBC_MAC_ROTATE_IN_PLACE)
1156 rotated_mac = rotated_mac_buf + ((0 - (size_t)rotated_mac_buf) & 63);
1159 /* This information is public so it's safe to branch based on it. */
1160 if (rec->orig_len > md_size + 255 + 1)
1161 scan_start = rec->orig_len - (md_size + 255 + 1);
1163 * div_spoiler contains a multiple of md_size that is used to cause the
1164 * modulo operation to be constant time. Without this, the time varies
1165 * based on the amount of padding when running on Intel chips at least.
1166 * The aim of right-shifting md_size is so that the compiler doesn't
1167 * figure out that it can remove div_spoiler as that would require it to
1168 * prove that md_size is always even, which I hope is beyond it.
1170 div_spoiler = md_size >> 1;
1171 div_spoiler <<= (sizeof(div_spoiler) - 1) * 8;
1172 rotate_offset = (div_spoiler + mac_start - scan_start) % md_size;
1174 memset(rotated_mac, 0, md_size);
1175 for (i = scan_start, j = 0; i < rec->orig_len; i++) {
1176 unsigned char mac_started = constant_time_ge_8(i, mac_start);
1177 unsigned char mac_ended = constant_time_ge_8(i, mac_end);
1178 unsigned char b = rec->data[i];
1179 rotated_mac[j++] |= b & mac_started & ~mac_ended;
1180 j &= constant_time_lt(j, md_size);
1183 /* Now rotate the MAC */
1184 #if defined(CBC_MAC_ROTATE_IN_PLACE)
1186 for (i = 0; i < md_size; i++) {
1187 /* in case cache-line is 32 bytes, touch second line */
1188 ((volatile unsigned char *)rotated_mac)[rotate_offset ^ 32];
1189 out[j++] = rotated_mac[rotate_offset++];
1190 rotate_offset &= constant_time_lt(rotate_offset, md_size);
1193 memset(out, 0, md_size);
1194 rotate_offset = md_size - rotate_offset;
1195 rotate_offset &= constant_time_lt(rotate_offset, md_size);
1196 for (i = 0; i < md_size; i++) {
1197 for (j = 0; j < md_size; j++)
1198 out[j] |= rotated_mac[i] & constant_time_eq_8(j, rotate_offset);
1200 rotate_offset &= constant_time_lt(rotate_offset, md_size);
1205 int dtls1_process_record(SSL *s)
1211 unsigned int mac_size;
1212 unsigned char md[EVP_MAX_MD_SIZE];
1214 rr = RECORD_LAYER_get_rrec(&s->rlayer);
1218 * At this point, s->packet_length == SSL3_RT_HEADER_LNGTH + rr->length,
1219 * and we have that many bytes in s->packet
1221 rr->input = &(RECORD_LAYER_get_packet(&s->rlayer)[DTLS1_RT_HEADER_LENGTH]);
1224 * ok, we can now read from 's->packet' data into 'rr' rr->input points
1225 * at rr->length bytes, which need to be copied into rr->data by either
1226 * the decryption or by the decompression When the data is 'copied' into
1227 * the rr->data buffer, rr->input will be pointed at the new buffer
1231 * We now have - encrypted [ MAC [ compressed [ plain ] ] ] rr->length
1232 * bytes of encrypted compressed stuff.
1235 /* check is not needed I believe */
1236 if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH) {
1237 al = SSL_AD_RECORD_OVERFLOW;
1238 SSLerr(SSL_F_DTLS1_PROCESS_RECORD, SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
1242 /* decrypt in place in 'rr->input' */
1243 rr->data = rr->input;
1244 rr->orig_len = rr->length;
1246 enc_err = s->method->ssl3_enc->enc(s, 0);
1249 * 0: (in non-constant time) if the record is publically invalid.
1250 * 1: if the padding is valid
1251 * -1: if the padding is invalid
1254 /* For DTLS we simply ignore bad packets. */
1256 RECORD_LAYER_reset_packet_length(&s->rlayer);
1260 printf("dec %d\n", rr->length);
1263 for (z = 0; z < rr->length; z++)
1264 printf("%02X%c", rr->data[z], ((z + 1) % 16) ? ' ' : '\n');
1269 /* r->length is now the compressed data plus mac */
1270 if ((sess != NULL) &&
1271 (s->enc_read_ctx != NULL) && (EVP_MD_CTX_md(s->read_hash) != NULL)) {
1272 /* s->read_hash != NULL => mac_size != -1 */
1273 unsigned char *mac = NULL;
1274 unsigned char mac_tmp[EVP_MAX_MD_SIZE];
1275 mac_size = EVP_MD_CTX_size(s->read_hash);
1276 OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);
1279 * orig_len is the length of the record before any padding was
1280 * removed. This is public information, as is the MAC in use,
1281 * therefore we can safely process the record in a different amount
1282 * of time if it's too short to possibly contain a MAC.
1284 if (rr->orig_len < mac_size ||
1285 /* CBC records must have a padding length byte too. */
1286 (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
1287 rr->orig_len < mac_size + 1)) {
1288 al = SSL_AD_DECODE_ERROR;
1289 SSLerr(SSL_F_DTLS1_PROCESS_RECORD, SSL_R_LENGTH_TOO_SHORT);
1293 if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE) {
1295 * We update the length so that the TLS header bytes can be
1296 * constructed correctly but we need to extract the MAC in
1297 * constant time from within the record, without leaking the
1298 * contents of the padding bytes.
1301 ssl3_cbc_copy_mac(mac_tmp, rr, mac_size);
1302 rr->length -= mac_size;
1305 * In this case there's no padding, so |rec->orig_len| equals
1306 * |rec->length| and we checked that there's enough bytes for
1309 rr->length -= mac_size;
1310 mac = &rr->data[rr->length];
1313 i = s->method->ssl3_enc->mac(s, md, 0 /* not send */ );
1314 if (i < 0 || mac == NULL
1315 || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0)
1317 if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH + mac_size)
1322 /* decryption failed, silently discard message */
1324 RECORD_LAYER_reset_packet_length(&s->rlayer);
1328 /* r->length is now just compressed */
1329 if (s->expand != NULL) {
1330 if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH) {
1331 al = SSL_AD_RECORD_OVERFLOW;
1332 SSLerr(SSL_F_DTLS1_PROCESS_RECORD,
1333 SSL_R_COMPRESSED_LENGTH_TOO_LONG);
1336 if (!ssl3_do_uncompress(s)) {
1337 al = SSL_AD_DECOMPRESSION_FAILURE;
1338 SSLerr(SSL_F_DTLS1_PROCESS_RECORD, SSL_R_BAD_DECOMPRESSION);
1343 if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH) {
1344 al = SSL_AD_RECORD_OVERFLOW;
1345 SSLerr(SSL_F_DTLS1_PROCESS_RECORD, SSL_R_DATA_LENGTH_TOO_LONG);
1351 * So at this point the following is true
1352 * ssl->s3->rrec.type is the type of record
1353 * ssl->s3->rrec.length == number of bytes in record
1354 * ssl->s3->rrec.off == offset to first valid byte
1355 * ssl->s3->rrec.data == where to take bytes from, increment
1359 /* we have pulled in a full packet so zero things */
1360 RECORD_LAYER_reset_packet_length(&s->rlayer);
1364 ssl3_send_alert(s, SSL3_AL_FATAL, al);
1371 * retrieve a buffered record that belongs to the current epoch, ie,
1374 #define dtls1_get_processed_record(s) \
1375 dtls1_retrieve_buffered_record((s), \
1376 &(DTLS_RECORD_LAYER_get_processed_rcds(&s->rlayer)))
1379 * Call this to get a new input record.
1380 * It will return <= 0 if more data is needed, normally due to an error
1381 * or non-blocking IO.
1382 * When it finishes, one packet has been decoded and can be found in
1383 * ssl->s3->rrec.type - is the type of record
1384 * ssl->s3->rrec.data, - data
1385 * ssl->s3->rrec.length, - number of bytes
1387 /* used only by dtls1_read_bytes */
1388 int dtls1_get_record(SSL *s)
1390 int ssl_major, ssl_minor;
1393 unsigned char *p = NULL;
1394 unsigned short version;
1395 DTLS1_BITMAP *bitmap;
1396 unsigned int is_next_epoch;
1398 rr = RECORD_LAYER_get_rrec(&s->rlayer);
1401 * The epoch may have changed. If so, process all the pending records.
1402 * This is a non-blocking operation.
1404 if (dtls1_process_buffered_records(s) < 0)
1407 /* if we're renegotiating, then there may be buffered records */
1408 if (dtls1_get_processed_record(s))
1411 /* get something from the wire */
1413 /* check if we have the header */
1414 if ((RECORD_LAYER_get_rstate(&s->rlayer) != SSL_ST_READ_BODY) ||
1415 (RECORD_LAYER_get_packet_length(&s->rlayer) < DTLS1_RT_HEADER_LENGTH)) {
1416 n = ssl3_read_n(s, DTLS1_RT_HEADER_LENGTH,
1417 SSL3_BUFFER_get_len(&s->rlayer.rbuf), 0);
1418 /* read timeout is handled by dtls1_read_bytes */
1420 return (n); /* error or non-blocking */
1422 /* this packet contained a partial record, dump it */
1423 if (RECORD_LAYER_get_packet_length(&s->rlayer) != DTLS1_RT_HEADER_LENGTH) {
1424 RECORD_LAYER_reset_packet_length(&s->rlayer);
1428 RECORD_LAYER_set_rstate(&s->rlayer, SSL_ST_READ_BODY);
1430 p = RECORD_LAYER_get_packet(&s->rlayer);
1432 if (s->msg_callback)
1433 s->msg_callback(0, 0, SSL3_RT_HEADER, p, DTLS1_RT_HEADER_LENGTH,
1434 s, s->msg_callback_arg);
1436 /* Pull apart the header into the DTLS1_RECORD */
1440 version = (ssl_major << 8) | ssl_minor;
1442 /* sequence number is 64 bits, with top 2 bytes = epoch */
1445 memcpy(&(RECORD_LAYER_get_read_sequence(&s->rlayer)[2]), p, 6);
1450 /* Lets check version */
1451 if (!s->first_packet) {
1452 if (version != s->version) {
1453 /* unexpected version, silently discard */
1455 RECORD_LAYER_reset_packet_length(&s->rlayer);
1460 if ((version & 0xff00) != (s->version & 0xff00)) {
1461 /* wrong version, silently discard record */
1463 RECORD_LAYER_reset_packet_length(&s->rlayer);
1467 if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH) {
1468 /* record too long, silently discard it */
1470 RECORD_LAYER_reset_packet_length(&s->rlayer);
1474 /* now s->rlayer.rstate == SSL_ST_READ_BODY */
1477 /* s->rlayer.rstate == SSL_ST_READ_BODY, get and decode the data */
1480 RECORD_LAYER_get_packet_length(&s->rlayer) - DTLS1_RT_HEADER_LENGTH) {
1481 /* now s->packet_length == DTLS1_RT_HEADER_LENGTH */
1483 n = ssl3_read_n(s, i, i, 1);
1484 /* this packet contained a partial record, dump it */
1487 RECORD_LAYER_reset_packet_length(&s->rlayer);
1492 * now n == rr->length, and s->packet_length ==
1493 * DTLS1_RT_HEADER_LENGTH + rr->length
1496 /* set state for later operations */
1497 RECORD_LAYER_set_rstate(&s->rlayer, SSL_ST_READ_HEADER);
1499 /* match epochs. NULL means the packet is dropped on the floor */
1500 bitmap = dtls1_get_bitmap(s, rr, &is_next_epoch);
1501 if (bitmap == NULL) {
1503 RECORD_LAYER_reset_packet_length(&s->rlayer); /* dump this record */
1504 goto again; /* get another record */
1506 #ifndef OPENSSL_NO_SCTP
1507 /* Only do replay check if no SCTP bio */
1508 if (!BIO_dgram_is_sctp(SSL_get_rbio(s))) {
1511 * Check whether this is a repeat, or aged record. Don't check if
1512 * we're listening and this message is a ClientHello. They can look
1513 * as if they're replayed, since they arrive from different
1514 * connections and would be dropped unnecessarily.
1516 if (!(s->d1->listen && rr->type == SSL3_RT_HANDSHAKE &&
1517 RECORD_LAYER_get_packet_length(&s->rlayer)
1518 > DTLS1_RT_HEADER_LENGTH &&
1519 RECORD_LAYER_get_packet(&s->rlayer)[DTLS1_RT_HEADER_LENGTH]
1520 == SSL3_MT_CLIENT_HELLO) &&
1521 !dtls1_record_replay_check(s, bitmap)) {
1523 RECORD_LAYER_reset_packet_length(&s->rlayer); /* dump this record */
1524 goto again; /* get another record */
1526 #ifndef OPENSSL_NO_SCTP
1530 /* just read a 0 length packet */
1531 if (rr->length == 0)
1535 * If this record is from the next epoch (either HM or ALERT), and a
1536 * handshake is currently in progress, buffer it since it cannot be
1537 * processed at this time. However, do not buffer anything while
1540 if (is_next_epoch) {
1541 if ((SSL_in_init(s) || s->in_handshake) && !s->d1->listen) {
1542 if (dtls1_buffer_record
1543 (s, &(DTLS_RECORD_LAYER_get_unprocessed_rcds(&s->rlayer)),
1546 /* Mark receipt of record. */
1547 dtls1_record_bitmap_update(s, bitmap);
1550 RECORD_LAYER_reset_packet_length(&s->rlayer);
1554 if (!dtls1_process_record(s)) {
1556 RECORD_LAYER_reset_packet_length(&s->rlayer); /* dump this record */
1557 goto again; /* get another record */
1559 dtls1_record_bitmap_update(s, bitmap); /* Mark receipt of record. */