Commit c649d10d authored by Todd Short's avatar Todd Short Committed by Matt Caswell
Browse files

TLS1.3 Padding 



Add padding callback for application control
Standard block_size callback
Documentation and tests included
Configuration file/s_client/s_srver option

Reviewed-by: default avatarTim Hudson <tjh@openssl.org>
Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3130)
parent 20ee2bf1

apps/apps.h

+5 −1
Original line number Diff line number Diff line
@@ -214,7 +214,7 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate, 
        OPT_S_SERVERPREF, OPT_S_LEGACYRENEG, OPT_S_LEGACYCONN, \

        OPT_S_ONRESUMP, OPT_S_NOLEGACYCONN, OPT_S_STRICT, OPT_S_SIGALGS, \

        OPT_S_CLIENTSIGALGS, OPT_S_CURVES, OPT_S_NAMEDCURVE, OPT_S_CIPHER, \

        OPT_S_DHPARAM, OPT_S_DEBUGBROKE, OPT_S_COMP, \

        OPT_S_DHPARAM, OPT_S_RECORD_PADDING, OPT_S_DEBUGBROKE, OPT_S_COMP, \

        OPT_S__LAST



# define OPT_S_OPTIONS \
@@ -251,9 +251,12 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate, 
        {"cipher", OPT_S_CIPHER, 's', "Specify cipher list to be used"}, \

        {"dhparam", OPT_S_DHPARAM, '<', \

            "DH parameter file to use, in cert file if not specified"}, \

        {"record_padding", OPT_S_RECORD_PADDING, 's', \

            "Block size to pad TLS 1.3 records to."}, \

        {"debug_broken_protocol", OPT_S_DEBUGBROKE, '-', \

            "Perform all sorts of protocol violations for testing purposes"}





# define OPT_S_CASES \

        OPT_S__FIRST: case OPT_S__LAST: break; \

        case OPT_S_NOSSL3: \
@@ -277,6 +280,7 @@ int set_cert_times(X509 *x, const char *startdate, const char *enddate, 
        case OPT_S_NAMEDCURVE: \

        case OPT_S_CIPHER: \

        case OPT_S_DHPARAM: \

        case OPT_S_RECORD_PADDING: \

        case OPT_S_DEBUGBROKE



#define IS_NO_PROT_FLAG(o) \

doc/man3/SSL_CONF_cmd.pod

+12 −0
Original line number Diff line number Diff line
@@ -110,6 +110,12 @@ Attempts to use the file B<value> as the set of temporary DH parameters for 
the appropriate context. This option is only supported if certificate

operations are permitted.



=item B<-record_padding>



Attempts to pad TLS 1.3 records so that they are a multiple of B<value> in

length on send. A B<value> of 0 or 1 turns off padding. Otherwise, the

B<value> must be >1 or <=16384.



=item B<-min_protocol>, B<-max_protocol>



Sets the minimum and maximum supported protocol.
@@ -236,6 +242,12 @@ Attempts to use the file B<value> as the set of temporary DH parameters for 
the appropriate context. This option is only supported if certificate

operations are permitted.



=item B<RecordPadding>



Attempts to pad TLS 1.3 records so that they are a multiple of B<value> in

length on send. A B<value> of 0 or 1 turns off padding. Otherwise, the

B<value> must be >1 or <=16384.



=item B<SignatureAlgorithms>



This sets the supported signature algorithms for TLS v1.2. For clients this

doc/man3/SSL_CTX_set_record_padding_callback.pod

0 → 100644
+96 −0
Original line number Diff line number Diff line 
=pod



=head1 NAME



SSL_CTX_set_record_padding_callback,

SSL_set_record_padding_callback,

SSL_CTX_set_record_padding_callback_arg,

SSL_set_record_padding_callback_arg,

SSL_CTX_get_record_padding_callback_arg,

SSL_get_record_padding_callback_arg,

SSL_CTX_set_block_padding,

SSL_set_block_padding - install callback to specify TLS 1.3 record padding



=head1 SYNOPSIS



 #include <openssl/ssl.h>



 void SSL_CTX_set_record_padding_callback(SSL_CTX *ctx, size_t (*cb)(SSL *s, int type, size_t len, void *arg));

 void SSL_set_record_padding_callback(SSL *ssl, size_t (*cb)(SSL *s, int type, size_t len, void *arg));



 void SSL_CTX_set_record_padding_callback_arg(SSL_CTX *ctx, void *arg);

 void *SSL_CTX_get_record_padding_callback_arg(SSL_CTX *ctx);



 void SSL_set_record_padding_callback_arg(SSL *ssl, void *arg);

 void *SSL_get_record_padding_callback_arg(SSL *ssl);



 int SSL_CTX_set_block_padding(SSL_CTX *ctx, size_t block_size);

 int SSL_set_block_padding(SSL *ssl, size_t block_size);



=head1 DESCRIPTION



SSL_CTX_set_record_padding_callback() or SSL_set_record_padding_callback()

can be used to assign a callback function I<cb> to specify the padding

for TLS 1.3 records. The value set in B<ctx> is copied to a new SSL by SSL_new().



SSL_CTX_set_record_padding_callback_arg() and SSL_set_record_padding_callback_arg()

assign a value B<arg> that is passed to the callback when it is invoked. The value

set in B<ctx> is copied to a new SSL by SSL_new().



SSL_CTX_get_record_padding_callback_arg() and SSL_get_record_padding_callback_arg()

retrieve the B<arg> value that is passed to the callback.



SSL_CTX_set_block_padding() and SSL_set_block_padding() pads the record to a multiple

of the B<block_size>. A B<block_size> of 0 or 1 disables block padding. The limit of

B<block_size> is SSL3_RT_MAX_PLAIN_LENGTH.



The callback is invoked for every record before encryption.

The B<type> parameter is the TLS record type that is being processed; may be

one of SSL3_RT_APPLICATION_DATA, SSL3_RT_HANDSHAKE, or SSL3_RT_ALERT.

The B<len> parameter is the current plaintext length of the record before encryption.

The B<arg> parameter is the value set via SSL_CTX_set_record_padding_callback_arg()

or SSL_set_record_padding_callback_arg().



=head1 RETURN VALUES



The SSL_CTX_get_record_padding_callback_arg() and SSL_get_record_padding_callback_arg()

functions return the B<arg> value assignd in the corresponding set functions.



The SSL_CTX_set_block_padding() and SSL_set_block_padding() functions return 1 on success

or 0 if B<block_size> is too large.



The B<cb> returns the number of padding bytes to add to the record. A return of 0

indicates no padding will be added. A return value that causes the record to

exceed the maximum record size (SSL3_RT_MAX_PLAIN_LENGTH) will pad out to the

maximum record size.



=head1 NOTES



The default behavior is to add no padding to the record.



A user-supplied padding callback function will override the behavior set by

SSL_set_block_padding() or SSL_CTX_set_block_padding(). Setting the user-supplied

callback to NULL will restore the configured block padding behavior.



These functions only apply to TLS 1.3 records being written.



Padding bytes are not added in constant-time.



=head1 SEE ALSO



L<ssl(7)>, L<SSL_new(3)>



=head1 HISTORY



The record padding API was added for TLS 1.3 support in OpenSSL 1.1.1.



=head1 COPYRIGHT



Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.



Licensed under the OpenSSL license (the "License").  You may not use

this file except in compliance with the License.  You can obtain a copy

in the file LICENSE in the source distribution or at

L<https://www.openssl.org/source/license.html>.



=cut

include/openssl/ssl.h

+15 −0
Original line number Diff line number Diff line
@@ -1952,6 +1952,21 @@ void SSL_set_not_resumable_session_callback(SSL *ssl, 
                                            int (*cb) (SSL *ssl,

                                                       int

                                                       is_forward_secure));



void SSL_CTX_set_record_padding_callback(SSL_CTX *ctx,

                                         size_t (*cb) (SSL *ssl, int type,

                                                       size_t len, void *arg));

void SSL_CTX_set_record_padding_callback_arg(SSL_CTX *ctx, void *arg);

void *SSL_CTX_get_record_padding_callback_arg(SSL_CTX *ctx);

int SSL_CTX_set_block_padding(SSL_CTX *ctx, size_t block_size);



void SSL_set_record_padding_callback(SSL *ssl,

                                    size_t (*cb) (SSL *ssl, int type,

                                                  size_t len, void *arg));

void SSL_set_record_padding_callback_arg(SSL *ssl, void *arg);

void *SSL_get_record_padding_callback_arg(SSL *ssl);

int SSL_set_block_padding(SSL *ssl, size_t block_size);



# if OPENSSL_API_COMPAT < 0x10100000L

#  define SSL_cache_hit(s) SSL_session_reused(s)

# endif

ssl/packet.c

+15 −0
Original line number Diff line number Diff line
@@ -350,6 +350,21 @@ int WPACKET_set_max_size(WPACKET *pkt, size_t maxsize) 
    return 1;

}



int WPACKET_memset(WPACKET *pkt, int ch, size_t len)

{

    unsigned char *dest;



    if (len == 0)

        return 1;



    if (!WPACKET_allocate_bytes(pkt, len, &dest))

        return 0;



    memset(dest, ch, len);



    return 1;

}



int WPACKET_memcpy(WPACKET *pkt, const void *src, size_t len)

{

    unsigned char *dest;