Set security level to zero is ssltest

[openssl.git] / ssl / s3_cbc.c

diff --git a/ssl/s3_cbc.c b/ssl/s3_cbc.c
index 005451a3b67dd09507453784c66bf8f6e4c90978..73e12b6799b3e95d02773ac772f7a81225666b7c 100644 (file)
--- a/ssl/s3_cbc.c
+++ b/ssl/s3_cbc.c
@@ -146,7 +146,7 @@ int tls1_cbc_remove_padding(const SSL* s,
        unsigned padding_length, good, to_check, i;
        const unsigned overhead = 1 /* padding length byte */ + mac_size;
        /* Check if version requires explicit IV */
-       if (s->version >= TLS1_1_VERSION || s->version == DTLS1_VERSION)
+       if (SSL_USE_EXPLICIT_IV(s))
                {
                /* These lengths are all public so we can test them in
                 * non-constant time.
@@ -229,10 +229,6 @@ int tls1_cbc_remove_padding(const SSL* s,
        return (int)((good & 1) | (~good & -1));
        }
 
-#if defined(_M_AMD64) || defined(__x86_64__)
-#define CBC_MAC_ROTATE_IN_PLACE
-#endif
-
 /* ssl3_cbc_copy_mac copies |md_size| bytes from the end of |rec| to |out| in
  * constant time (independent of the concrete value of rec->length, which may
  * vary within a 256-byte window).
@@ -246,15 +242,18 @@ int tls1_cbc_remove_padding(const SSL* s,
  *
  * If CBC_MAC_ROTATE_IN_PLACE is defined then the rotation is performed with
  * variable accesses in a 64-byte-aligned buffer. Assuming that this fits into
- * a single cache-line, then the variable memory accesses don't actually affect
- * the timing. This has been tested to be true on Intel amd64 chips.
+ * a single or pair of cache-lines, then the variable memory accesses don't
+ * actually affect the timing. CPUs with smaller cache-lines [if any] are
+ * not multi-core and are not considered vulnerable to cache-timing attacks.
  */
+#define CBC_MAC_ROTATE_IN_PLACE
+
 void ssl3_cbc_copy_mac(unsigned char* out,
                       const SSL3_RECORD *rec,
                       unsigned md_size)
        {
 #if defined(CBC_MAC_ROTATE_IN_PLACE)
-       unsigned char rotated_mac_buf[EVP_MAX_MD_SIZE*2];
+       unsigned char rotated_mac_buf[64+EVP_MAX_MD_SIZE];
        unsigned char *rotated_mac;
 #else
        unsigned char rotated_mac[EVP_MAX_MD_SIZE];
@@ -274,7 +273,7 @@ void ssl3_cbc_copy_mac(unsigned char* out,
        OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE);
 
 #if defined(CBC_MAC_ROTATE_IN_PLACE)
-       rotated_mac = (unsigned char*) (((intptr_t)(rotated_mac_buf + 64)) & ~63);
+       rotated_mac = rotated_mac_buf + ((0-(size_t)rotated_mac_buf)&63);
 #endif
 
        /* This information is public so it's safe to branch based on it. */
@@ -306,6 +305,8 @@ void ssl3_cbc_copy_mac(unsigned char* out,
        j = 0;
        for (i = 0; i < md_size; i++)
                {
+               /* in case cache-line is 32 bytes, touch second line */
+               ((volatile unsigned char *)rotated_mac)[rotate_offset^32];
                out[j++] = rotated_mac[rotate_offset++];
                rotate_offset &= constant_time_lt(rotate_offset,md_size);
                }
@@ -418,7 +419,7 @@ char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
  *   md_out: the digest output. At most EVP_MAX_MD_SIZE bytes will be written.
  *   md_out_size: if non-NULL, the number of output bytes is written here.
  *   header: the 13-byte, TLS record header.
- *   data: the record data itself, less any preceeding explicit IV.
+ *   data: the record data itself, less any preceding explicit IV.
  *   data_plus_mac_size: the secret, reported length of the data and MAC
  *     once the padding has been removed.
  *   data_plus_mac_plus_padding_size: the public length of the whole
@@ -461,6 +462,7 @@ void ssl3_cbc_digest_record(
        * the hash. */
        unsigned md_length_size = 8;
        char length_is_big_endian = 1;
+       int ret;
 
        /* This is a, hopefully redundant, check that allows us to forget about
         * many possible overflows later in this function. */
@@ -732,8 +734,8 @@ void ssl3_cbc_digest_record(
                EVP_DigestUpdate(&md_ctx, hmac_pad, md_block_size);
                EVP_DigestUpdate(&md_ctx, mac_out, md_size);
                }
-       EVP_DigestFinal(&md_ctx, md_out, &md_out_size_u);
-       if (md_out_size)
+       ret = EVP_DigestFinal(&md_ctx, md_out, &md_out_size_u);
+       if (ret && md_out_size)
                *md_out_size = md_out_size_u;
        EVP_MD_CTX_cleanup(&md_ctx);
        }