DTLS/SCTP Finished Auth Bug

[openssl.git] / ssl / t1_enc.c

diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
index 8153b2ca4326dfbd9b54f3a47e18e8266c3d4b59..7155fd06bc48e2632784d76babda1f46e1a1bed6 100644 (file)
--- a/ssl/t1_enc.c
+++ b/ssl/t1_enc.c
@@ -616,7 +616,7 @@ int tls1_setup_key_block(SSL *s)
        if (s->s3->tmp.key_block_length != 0)
                return(1);
 
-       if (!ssl_cipher_get_evp(s->session,&c,&hash,&mac_type,&mac_secret_size,&comp))
+       if (!ssl_cipher_get_evp(s->session,&c,&hash,&mac_type,&mac_secret_size,&comp, SSL_USE_ETM(s)))
                {
                SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK,SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
                return(0);
@@ -691,6 +691,15 @@ err:
        return(ret);
        }
 
+/* tls1_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
+ *
+ * Returns:
+ *   0: (in non-constant time) if the record is publically invalid (i.e. too
+ *       short etc).
+ *   1: if the record's padding is valid / the encryption was successful.
+ *   -1: if the record's padding/AEAD-authenticator is invalid or, if sending,
+ *       an internal error occurred.
+ */
 int tls1_enc(SSL *s, int send)
        {
        SSL3_RECORD *rec;
@@ -715,7 +724,7 @@ int tls1_enc(SSL *s, int send)
                        int ivlen;
                        enc=EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
                        /* For TLSv1.1 and later explicit IV */
-                       if (s->version >= TLS1_1_VERSION
+                       if (SSL_USE_EXPLICIT_IV(s)
                                && EVP_CIPHER_mode(enc) == EVP_CIPH_CBC_MODE)
                                ivlen = EVP_CIPHER_iv_length(enc);
                        else
@@ -770,7 +779,7 @@ int tls1_enc(SSL *s, int send)
 
                        seq = send?s->s3->write_sequence:s->s3->read_sequence;
 
-                       if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
+                       if (SSL_IS_DTLS(s))
                                {
                                unsigned char dtlsseq[9],*p=dtlsseq;
 
@@ -840,13 +849,7 @@ int tls1_enc(SSL *s, int send)
                if (!send)
                        {
                        if (l == 0 || l%bs != 0)
-                               {
-                               if (s->version >= TLS1_1_VERSION)
-                                       return -1;
-                               SSLerr(SSL_F_TLS1_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
-                               ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED);
                                return 0;
-                               }
                        }
                
                i = EVP_Cipher(ds,rec->data,rec->input,l);
@@ -870,10 +873,8 @@ int tls1_enc(SSL *s, int send)
                }
 #endif /* KSSL_DEBUG */
 
-               rec->orig_len = rec->length;
-
                ret = 1;
-               if (EVP_MD_CTX_md(s->read_hash) != NULL)
+               if (!SSL_USE_ETM(s) && EVP_MD_CTX_md(s->read_hash) != NULL)
                        mac_size = EVP_MD_CTX_size(s->read_hash);
                if ((bs != 1) && !send)
                        ret = tls1_cbc_remove_padding(s, rec, bs, mac_size);
@@ -1007,7 +1008,7 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send)
                        mac_ctx = &hmac;
                }
 
-       if (ssl->version == DTLS1_VERSION || ssl->version == DTLS1_BAD_VER)
+       if (SSL_IS_DTLS(ssl))
                {
                unsigned char dtlsseq[8],*p=dtlsseq;
 
@@ -1025,7 +1026,7 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send)
        header[11]=(rec->length)>>8;
        header[12]=(rec->length)&0xff;
 
-       if (!send &&
+       if (!send && !SSL_USE_ETM(ssl) &&
            EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
            ssl3_cbc_record_digest_supported(mac_ctx))
                {
@@ -1048,6 +1049,13 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send)
                EVP_DigestSignUpdate(mac_ctx,rec->input,rec->length);
                t=EVP_DigestSignFinal(mac_ctx,md,&md_size);
                OPENSSL_assert(t > 0);
+#ifdef OPENSSL_FIPS
+               if (!send && !SSL_USE_ETM(ssl) && FIPS_mode())
+                       tls_fips_digest_extra(
+                                       ssl->enc_read_ctx,
+                                       mac_ctx, rec->input,
+                                       rec->length, rec->orig_len);
+#endif
                }
                
        if (!stream_mac)
@@ -1063,7 +1071,7 @@ printf("rec=");
 {unsigned int z; for (z=0; z<rec->length; z++) printf("%02X ",buf[z]); printf("\n"); }
 #endif
 
-       if (ssl->version != DTLS1_VERSION && ssl->version != DTLS1_BAD_VER)
+       if (!SSL_IS_DTLS(ssl))
                {
                for (i=7; i>=0; i--)
                        {