2 * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include <openssl/evp.h>
11 #include <openssl/core_names.h>
12 #include "../../ssl_local.h"
13 #include "../record_local.h"
14 #include "recmethod_local.h"
16 static int tls13_set_crypto_state(OSSL_RECORD_LAYER *rl, int level,
17 unsigned char *key, size_t keylen,
18 unsigned char *iv, size_t ivlen,
19 unsigned char *mackey, size_t mackeylen,
20 const EVP_CIPHER *ciph,
26 EVP_CIPHER_CTX *ciph_ctx;
28 int enc = (rl->direction == OSSL_RECORD_DIRECTION_WRITE) ? 1 : 0;
30 if (ivlen > sizeof(rl->iv)) {
31 ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
32 return OSSL_RECORD_RETURN_FATAL;
34 memcpy(rl->iv, iv, ivlen);
36 ciph_ctx = rl->enc_ctx = EVP_CIPHER_CTX_new();
37 if (ciph_ctx == NULL) {
38 ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
39 return OSSL_RECORD_RETURN_FATAL;
42 mode = EVP_CIPHER_get_mode(ciph);
44 if (EVP_CipherInit_ex(ciph_ctx, ciph, NULL, NULL, NULL, enc) <= 0
45 || EVP_CIPHER_CTX_ctrl(ciph_ctx, EVP_CTRL_AEAD_SET_IVLEN, ivlen,
47 || (mode == EVP_CIPH_CCM_MODE
48 && EVP_CIPHER_CTX_ctrl(ciph_ctx, EVP_CTRL_AEAD_SET_TAG, taglen,
50 || EVP_CipherInit_ex(ciph_ctx, NULL, NULL, key, NULL, enc) <= 0) {
51 ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
52 return OSSL_RECORD_RETURN_FATAL;
55 return OSSL_RECORD_RETURN_SUCCESS;
58 static int tls13_cipher(OSSL_RECORD_LAYER *rl, SSL3_RECORD *recs, size_t n_recs,
59 int sending, SSL_MAC_BUF *mac, size_t macsize)
62 unsigned char iv[EVP_MAX_IV_LENGTH], recheader[SSL3_RT_HEADER_LENGTH];
63 size_t ivlen, offset, loop, hdrlen;
64 unsigned char *staticiv;
65 unsigned char *seq = rl->sequence;
67 SSL3_RECORD *rec = &recs[0];
69 const EVP_CIPHER *cipher;
73 /* Should not happen */
74 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
81 cipher = EVP_CIPHER_CTX_get0_cipher(ctx);
83 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
86 mode = EVP_CIPHER_get_mode(cipher);
89 * If we're sending an alert and ctx != NULL then we must be forcing
90 * plaintext alerts. If we're reading and ctx != NULL then we allow
91 * plaintext alerts at certain points in the handshake. If we've got this
92 * far then we have already validated that a plaintext alert is ok here.
94 if (ctx == NULL || rec->type == SSL3_RT_ALERT) {
95 memmove(rec->data, rec->input, rec->length);
96 rec->input = rec->data;
100 ivlen = EVP_CIPHER_CTX_get_iv_length(ctx);
104 * Take off tag. There must be at least one byte of content type as
107 if (rec->length < rl->taglen + 1)
109 rec->length -= rl->taglen;
113 if (ivlen < SEQ_NUM_SIZE) {
114 /* Should not happen */
115 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
118 offset = ivlen - SEQ_NUM_SIZE;
119 memcpy(iv, staticiv, offset);
120 for (loop = 0; loop < SEQ_NUM_SIZE; loop++)
121 iv[offset + loop] = staticiv[offset + loop] ^ seq[loop];
123 if (!tls_increment_sequence_ctr(rl)) {
124 /* RLAYERfatal already called */
128 if (EVP_CipherInit_ex(ctx, NULL, NULL, NULL, iv, sending) <= 0
129 || (!sending && EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
131 rec->data + rec->length) <= 0)) {
132 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
137 if (!WPACKET_init_static_len(&wpkt, recheader, sizeof(recheader), 0)
138 || !WPACKET_put_bytes_u8(&wpkt, rec->type)
139 || !WPACKET_put_bytes_u16(&wpkt, rec->rec_version)
140 || !WPACKET_put_bytes_u16(&wpkt, rec->length + rl->taglen)
141 || !WPACKET_get_total_written(&wpkt, &hdrlen)
142 || hdrlen != SSL3_RT_HEADER_LENGTH
143 || !WPACKET_finish(&wpkt)) {
144 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
145 WPACKET_cleanup(&wpkt);
150 * For CCM we must explicitly set the total plaintext length before we add
153 if ((mode == EVP_CIPH_CCM_MODE
154 && EVP_CipherUpdate(ctx, NULL, &lenu, NULL,
155 (unsigned int)rec->length) <= 0)
156 || EVP_CipherUpdate(ctx, NULL, &lenu, recheader,
157 sizeof(recheader)) <= 0
158 || EVP_CipherUpdate(ctx, rec->data, &lenu, rec->input,
159 (unsigned int)rec->length) <= 0
160 || EVP_CipherFinal_ex(ctx, rec->data + lenu, &lenf) <= 0
161 || (size_t)(lenu + lenf) != rec->length) {
166 if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, rl->taglen,
167 rec->data + rec->length) <= 0) {
168 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
171 rec->length += rl->taglen;
177 static int tls13_validate_record_header(OSSL_RECORD_LAYER *rl, SSL3_RECORD *rec)
179 if (rec->type != SSL3_RT_APPLICATION_DATA
180 && (rec->type != SSL3_RT_CHANGE_CIPHER_SPEC
181 || !rl->is_first_handshake)
182 && (rec->type != SSL3_RT_ALERT || !rl->allow_plain_alerts)) {
183 RLAYERfatal(rl, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_BAD_RECORD_TYPE);
187 if (rec->rec_version != TLS1_2_VERSION) {
188 RLAYERfatal(rl, SSL_AD_DECODE_ERROR, SSL_R_WRONG_VERSION_NUMBER);
192 if (rec->length > SSL3_RT_MAX_TLS13_ENCRYPTED_LENGTH) {
193 RLAYERfatal(rl, SSL_AD_RECORD_OVERFLOW,
194 SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
200 static int tls13_post_process_record(OSSL_RECORD_LAYER *rl, SSL3_RECORD *rec)
202 /* Skip this if we've received a plaintext alert */
203 if (rec->type != SSL3_RT_ALERT) {
207 || rec->type != SSL3_RT_APPLICATION_DATA) {
208 RLAYERfatal(rl, SSL_AD_UNEXPECTED_MESSAGE,
209 SSL_R_BAD_RECORD_TYPE);
213 /* Strip trailing padding */
214 for (end = rec->length - 1; end > 0 && rec->data[end] == 0; end--)
218 rec->type = rec->data[end];
221 if (rec->length > SSL3_RT_MAX_PLAIN_LENGTH) {
222 RLAYERfatal(rl, SSL_AD_RECORD_OVERFLOW, SSL_R_DATA_LENGTH_TOO_LONG);
226 if (!tls13_common_post_process_record(rl, rec)) {
227 /* RLAYERfatal already called */
234 static unsigned int tls13_get_record_type(OSSL_RECORD_LAYER *rl,
235 OSSL_RECORD_TEMPLATE *template)
237 if (rl->allow_plain_alerts && template->type == SSL3_RT_ALERT)
238 return SSL3_RT_ALERT;
241 * Aside from the above case we always use the application data record type
242 * when encrypting in TLSv1.3. The "inner" record type encodes the "real"
243 * record type from the template.
245 return SSL3_RT_APPLICATION_DATA;
248 static int tls13_add_record_padding(OSSL_RECORD_LAYER *rl,
249 OSSL_RECORD_TEMPLATE *thistempl,
255 /* Nothing to be done in the case of a plaintext alert */
256 if (rl->allow_plain_alerts && thistempl->type != SSL3_RT_ALERT)
259 if (!WPACKET_put_bytes_u8(thispkt, thistempl->type)) {
260 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
263 SSL3_RECORD_add_length(thiswr, 1);
265 /* Add TLS1.3 padding */
266 rlen = SSL3_RECORD_get_length(thiswr);
267 if (rlen < rl->max_frag_len) {
269 size_t max_padding = rl->max_frag_len - rlen;
271 if (rl->padding != NULL) {
272 padding = rl->padding(rl->cbarg, thistempl->type, rlen);
273 } else if (rl->block_padding > 0) {
274 size_t mask = rl->block_padding - 1;
277 /* optimize for power of 2 */
278 if ((rl->block_padding & mask) == 0)
279 remainder = rlen & mask;
281 remainder = rlen % rl->block_padding;
282 /* don't want to add a block of padding if we don't have to */
286 padding = rl->block_padding - remainder;
289 /* do not allow the record to exceed max plaintext length */
290 if (padding > max_padding)
291 padding = max_padding;
292 if (!WPACKET_memset(thispkt, 0, padding)) {
293 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR,
294 ERR_R_INTERNAL_ERROR);
297 SSL3_RECORD_add_length(thiswr, padding);
304 struct record_functions_st tls_1_3_funcs = {
305 tls13_set_crypto_state,
308 tls_default_set_protocol_version,
310 tls_get_more_records,
311 tls13_validate_record_header,
312 tls13_post_process_record,
313 tls_get_max_records_default,
314 tls_write_records_default,
315 tls_allocate_write_buffers_default,
316 tls_initialise_write_packets_default,
317 tls13_get_record_type,
318 tls_prepare_record_header_default,
319 tls13_add_record_padding,
320 tls_prepare_for_encryption_default,
321 tls_post_encryption_processing_default,