Add support for canonical generation of DSA parameter g.

[openssl.git] / ssl / t1_enc.c

diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
index c60bccd2c00b1af21ad7a306ca1e76679e5dc87f..3452b25c456f0ee33235c3833e2ee6ae8bce6b72 100644 (file)
--- a/ssl/t1_enc.c
+++ b/ssl/t1_enc.c
@@ -171,6 +171,8 @@ static int tls1_P_hash(const EVP_MD *md, const unsigned char *sec,
 
        EVP_MD_CTX_init(&ctx);
        EVP_MD_CTX_init(&ctx_tmp);
+       EVP_MD_CTX_set_flags(&ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+       EVP_MD_CTX_set_flags(&ctx_tmp, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
        mac_key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, sec, sec_len);
        if (!mac_key)
                goto err;
@@ -263,6 +265,8 @@ static int tls1_PRF(long digest_mask,
                if ((m<<TLS1_PRF_DGST_SHIFT) & digest_mask) count++;
        }       
        len=slen/count;
+       if (count == 1)
+               slen = 0;
        S1=sec;
        memset(out1,0,olen);
        for (idx=0;ssl_get_handshake_digest(idx,&m,&md);idx++) {
@@ -365,7 +369,7 @@ int tls1_change_cipher_state(SSL *s, int which)
                {
                if (s->s3->tmp.new_cipher->algorithm2 & TLS1_STREAM_MAC)
                        s->mac_flags |= SSL_MAC_FLAG_READ_MAC_STREAM;
-                       else
+               else
                        s->mac_flags &= ~SSL_MAC_FLAG_READ_MAC_STREAM;
 
                if (s->enc_read_ctx != NULL)
@@ -452,7 +456,11 @@ int tls1_change_cipher_state(SSL *s, int which)
        j=is_export ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ?
                       cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl;
        /* Was j=(exp)?5:EVP_CIPHER_key_length(c); */
-       k=EVP_CIPHER_iv_length(c);
+       /* If GCM mode only part of IV comes from PRF */
+       if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE)
+               k = EVP_GCM_TLS_FIXED_IV_LEN;
+       else
+               k=EVP_CIPHER_iv_length(c);
        if (    (which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
                (which == SSL3_CHANGE_CIPHER_SERVER_READ))
                {
@@ -481,10 +489,14 @@ int tls1_change_cipher_state(SSL *s, int which)
                }
 
        memcpy(mac_secret,ms,i);
-       mac_key = EVP_PKEY_new_mac_key(mac_type, NULL,
-                       mac_secret,*mac_secret_size);
-       EVP_DigestSignInit(mac_ctx,NULL,m,NULL,mac_key);
-       EVP_PKEY_free(mac_key);
+
+       if (!(EVP_CIPHER_flags(c)&EVP_CIPH_FLAG_AEAD_CIPHER))
+               {
+               mac_key = EVP_PKEY_new_mac_key(mac_type, NULL,
+                               mac_secret,*mac_secret_size);
+               EVP_DigestSignInit(mac_ctx,NULL,m,NULL,mac_key);
+               EVP_PKEY_free(mac_key);
+               }
 #ifdef TLS_DEBUG
 printf("which = %04X\nmac key=",which);
 { int z; for (z=0; z<i; z++) printf("%02X%c",ms[z],((z+1)%16)?' ':'\n'); }
@@ -531,7 +543,19 @@ printf("which = %04X\nmac key=",which);
        }
 #endif /* KSSL_DEBUG */
 
-       EVP_CipherInit_ex(dd,c,NULL,key,iv,(which & SSL3_CC_WRITE));
+       if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE)
+               {
+               EVP_CipherInit_ex(dd,c,NULL,key,NULL,(which & SSL3_CC_WRITE));
+               EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GCM_SET_IV_FIXED, k, iv);
+               }
+       else    
+               EVP_CipherInit_ex(dd,c,NULL,key,iv,(which & SSL3_CC_WRITE));
+
+       /* Needed for "composite" AEADs, such as RC4-HMAC-MD5 */
+       if ((EVP_CIPHER_flags(c)&EVP_CIPH_FLAG_AEAD_CIPHER) && *mac_secret_size)
+               EVP_CIPHER_CTX_ctrl(dd,EVP_CTRL_AEAD_SET_MAC_KEY,
+                               *mac_secret_size,mac_secret);
+
 #ifdef TLS_DEBUG
 printf("which = %04X\nkey=",which);
 { int z; for (z=0; z<EVP_CIPHER_key_length(c); z++) printf("%02X%c",key[z],((z+1)%16)?' ':'\n'); }
@@ -648,14 +672,14 @@ int tls1_enc(SSL *s, int send)
        SSL3_RECORD *rec;
        EVP_CIPHER_CTX *ds;
        unsigned long l;
-       int bs,i,ii,j,k,n=0;
+       int bs,i,ii,j,k,pad=0;
        const EVP_CIPHER *enc;
 
        if (send)
                {
                if (EVP_MD_CTX_md(s->write_hash))
                        {
-                       n=EVP_MD_CTX_size(s->write_hash);
+                       int n=EVP_MD_CTX_size(s->write_hash);
                        OPENSSL_assert(n >= 0);
                        }
                ds=s->enc_write_ctx;
@@ -675,12 +699,12 @@ int tls1_enc(SSL *s, int send)
                        if (ivlen > 1)
                                {
                                if ( rec->data != rec->input)
-                               /* we can't write into the input stream:
-                                * Can this ever happen?? (steve)
-                                */
-                               fprintf(stderr,
-                                       "%s:%d: rec->data != rec->input\n",
-                                       __FILE__, __LINE__);
+                                       /* we can't write into the input stream:
+                                        * Can this ever happen?? (steve)
+                                        */
+                                       fprintf(stderr,
+                                               "%s:%d: rec->data != rec->input\n",
+                                               __FILE__, __LINE__);
                                else if (RAND_bytes(rec->input, ivlen) <= 0)
                                        return -1;
                                }
@@ -690,7 +714,7 @@ int tls1_enc(SSL *s, int send)
                {
                if (EVP_MD_CTX_md(s->read_hash))
                        {
-                       n=EVP_MD_CTX_size(s->read_hash);
+                       int n=EVP_MD_CTX_size(s->read_hash);
                        OPENSSL_assert(n >= 0);
                        }
                ds=s->enc_read_ctx;
@@ -716,7 +740,43 @@ int tls1_enc(SSL *s, int send)
                l=rec->length;
                bs=EVP_CIPHER_block_size(ds->cipher);
 
-               if ((bs != 1) && send)
+               if (EVP_CIPHER_flags(ds->cipher)&EVP_CIPH_FLAG_AEAD_CIPHER)
+                       {
+                       unsigned char buf[13],*seq;
+
+                       seq = send?s->s3->write_sequence:s->s3->read_sequence;
+
+                       if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
+                               {
+                               unsigned char dtlsseq[9],*p=dtlsseq;
+
+                               s2n(send?s->d1->w_epoch:s->d1->r_epoch,p);
+                               memcpy(p,&seq[2],6);
+                               memcpy(buf,dtlsseq,8);
+                               }
+                       else
+                               {
+                               memcpy(buf,seq,8);
+                               for (i=7; i>=0; i--)    /* increment */
+                                       {
+                                       ++seq[i];
+                                       if (seq[i] != 0) break; 
+                                       }
+                               }
+
+                       buf[8]=rec->type;
+                       buf[9]=(unsigned char)(s->version>>8);
+                       buf[10]=(unsigned char)(s->version);
+                       buf[11]=rec->length>>8;
+                       buf[12]=rec->length&0xff;
+                       pad=EVP_CIPHER_CTX_ctrl(ds,EVP_CTRL_AEAD_TLS1_AAD,13,buf);
+                       if (send)
+                               {
+                               l+=pad;
+                               rec->length+=pad;
+                               }
+                       }
+               else if ((bs != 1) && send)
                        {
                        i=bs-((int)l%bs);
 
@@ -765,7 +825,14 @@ int tls1_enc(SSL *s, int send)
                                }
                        }
                
-               EVP_Cipher(ds,rec->data,rec->input,l);
+               if (EVP_Cipher(ds,rec->data,rec->input,l) < 0)
+                       return -1;      /* AEAD can fail to verify MAC */
+               if (EVP_CIPHER_mode(enc) == EVP_CIPH_GCM_MODE && !send)
+                       {
+                       rec->data += EVP_GCM_TLS_EXPLICIT_IV_LEN;
+                       rec->input += EVP_GCM_TLS_EXPLICIT_IV_LEN;
+                       rec->length -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
+                       }
 
 #ifdef KSSL_DEBUG
                {
@@ -824,6 +891,8 @@ int tls1_enc(SSL *s, int send)
                                rec->length -= bs;
                                }
                        }
+               if (pad && !send)
+                       rec->length -= pad;
                }
        return(1);
        }