Commit dd7e60bd authored by Andy Polyakov's avatar Andy Polyakov
Browse files

ssl/*: revert "remove SSL_RECORD->orig_len" and merge "fix IV". 

Revert is appropriate because binary compatibility is not an issue
in 1.1.
parent 32620fe9

ssl/d1_pkt.c

+6 −6
Original line number Diff line number Diff line
@@ -379,7 +379,7 @@ dtls1_process_record(SSL *s) 
	int enc_err;

	SSL_SESSION *sess;

	SSL3_RECORD *rr;

	unsigned int mac_size, orig_len;

	unsigned int mac_size;

	unsigned char md[EVP_MAX_MD_SIZE];



	rr= &(s->s3->rrec);
@@ -410,7 +410,7 @@ dtls1_process_record(SSL *s) 


	/* decrypt in place in 'rr->input' */

	rr->data=rr->input;

	orig_len=rr->length;

	rr->orig_len=rr->length;



	enc_err = s->method->ssl3_enc->enc(s,0);

	/* enc_err is:
@@ -447,10 +447,10 @@ printf("\n"); 
		 * therefore we can safely process the record in a different

		 * amount of time if it's too short to possibly contain a MAC.

		 */

		if (orig_len < mac_size ||

		if (rr->orig_len < mac_size ||

		    /* CBC records must have a padding length byte too. */

		    (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&

		     orig_len < mac_size+1))

		     rr->orig_len < mac_size+1))

			{

			al=SSL_AD_DECODE_ERROR;

			SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT);
@@ -465,12 +465,12 @@ printf("\n"); 
			 * without leaking the contents of the padding bytes.

			 * */

			mac = mac_tmp;

			ssl3_cbc_copy_mac(mac_tmp, rr, mac_size, orig_len);

			ssl3_cbc_copy_mac(mac_tmp, rr, mac_size);

			rr->length -= mac_size;

			}

		else

			{

			/* In this case there's no padding, so |orig_len|

			/* In this case there's no padding, so |rec->orig_len|

			 * equals |rec->length| and we checked that there's

			 * enough bytes for |mac_size| above. */

			rr->length -= mac_size;

ssl/s3_cbc.c

+21 −33
Original line number Diff line number Diff line
@@ -116,9 +116,7 @@ int ssl3_cbc_remove_padding(const SSL* s, 
	good = constant_time_ge(rec->length, padding_length+overhead);

	/* SSLv3 requires that the padding is minimal. */

	good &= constant_time_ge(block_size, padding_length+1);

	padding_length = good & (padding_length+1);

	rec->length -= padding_length;

	rec->type |= padding_length<<8;	/* kludge: pass padding length */

	rec->length -= good & (padding_length+1);

	return (int)((good & 1) | (~good & -1));

}
@@ -139,31 +137,23 @@ int tls1_cbc_remove_padding(const SSL* s, 
			    unsigned mac_size)

	{

	unsigned padding_length, good, to_check, i;

	const char has_explicit_iv =

		s->version >= TLS1_1_VERSION || s->version == DTLS1_VERSION;

	const unsigned overhead = 1 /* padding length byte */ +

				  mac_size +

				  (has_explicit_iv ? block_size : 0);



	/* These lengths are all public so we can test them in non-constant

	 * time. */

	if (overhead > rec->length)

		return 0;



	/* We can always safely skip the explicit IV. We check at the beginning

	 * of this function that the record has at least enough space for the

	 * IV, MAC and padding length byte. (These can be checked in

	 * non-constant time because it's all public information.) So, if the

	 * padding was invalid, then we didn't change |rec->length| and this is

	 * safe. If the padding was valid then we know that we have at least

	 * overhead+padding_length bytes of space and so this is still safe

	 * because overhead accounts for the explicit IV. */

	if (has_explicit_iv)

	const unsigned overhead = 1 /* padding length byte */ + mac_size;

	/* Check if version requires explicit IV */

	if (s->version >= TLS1_1_VERSION || s->version == DTLS1_VERSION)

		{

		/* These lengths are all public so we can test them in

		 * non-constant time.

		 */

		if (overhead + block_size > rec->length)

			return 0;

		/* We can now safely skip explicit IV */

		rec->data += block_size;

		rec->input += block_size;

		rec->length -= block_size;

		rec->orig_len -= block_size;

		}

	else if (overhead > rec->length)

		return 0;



	padding_length = rec->data[rec->length-1];
@@ -190,7 +180,7 @@ int tls1_cbc_remove_padding(const SSL* s, 
	if (EVP_CIPHER_flags(s->enc_read_ctx->cipher)&EVP_CIPH_FLAG_AEAD_CIPHER)

		{

		/* padding is already verified */

		rec->length -= padding_length;

		rec->length -= padding_length + 1;

		return 1;

		}
@@ -227,9 +217,7 @@ int tls1_cbc_remove_padding(const SSL* s, 
	good <<= sizeof(good)*8-1;

	good = DUPLICATE_MSB_TO_ALL(good);



	padding_length = good & (padding_length+1);

	rec->length -= padding_length;

	rec->type |= padding_length<<8;	/* kludge: pass padding length */

	rec->length -= good & (padding_length+1);



	return (int)((good & 1) | (~good & -1));

	}
@@ -256,7 +244,7 @@ int tls1_cbc_remove_padding(const SSL* s, 
 */

void ssl3_cbc_copy_mac(unsigned char* out,

		       const SSL3_RECORD *rec,

		       unsigned md_size,unsigned orig_len)

		       unsigned md_size)

	{

#if defined(CBC_MAC_ROTATE_IN_PLACE)

	unsigned char rotated_mac_buf[EVP_MAX_MD_SIZE*2];
@@ -275,7 +263,7 @@ void ssl3_cbc_copy_mac(unsigned char* out, 
	unsigned div_spoiler;

	unsigned rotate_offset;



	OPENSSL_assert(orig_len >= md_size);

	OPENSSL_assert(rec->orig_len >= md_size);

	OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE);



#if defined(CBC_MAC_ROTATE_IN_PLACE)
@@ -283,8 +271,8 @@ void ssl3_cbc_copy_mac(unsigned char* out, 
#endif



	/* This information is public so it's safe to branch based on it. */

	if (orig_len > md_size + 255 + 1)

		scan_start = orig_len - (md_size + 255 + 1);

	if (rec->orig_len > md_size + 255 + 1)

		scan_start = rec->orig_len - (md_size + 255 + 1);

	/* div_spoiler contains a multiple of md_size that is used to cause the

	 * modulo operation to be constant time. Without this, the time varies

	 * based on the amount of padding when running on Intel chips at least.
@@ -297,9 +285,9 @@ void ssl3_cbc_copy_mac(unsigned char* out, 
	rotate_offset = (div_spoiler + mac_start - scan_start) % md_size;



	memset(rotated_mac, 0, md_size);

	for (i = scan_start; i < orig_len;)

	for (i = scan_start; i < rec->orig_len;)

		{

		for (j = 0; j < md_size && i < orig_len; i++, j++)

		for (j = 0; j < md_size && i < rec->orig_len; i++, j++)

			{

			unsigned char mac_started = constant_time_ge(i, mac_start);

			unsigned char mac_ended = constant_time_ge(i, mac_end);

ssl/s3_enc.c

+2 −6
Original line number Diff line number Diff line
@@ -730,7 +730,7 @@ int n_ssl3_mac(SSL *ssl, unsigned char *md, int send) 
	EVP_MD_CTX md_ctx;

	const EVP_MD_CTX *hash;

	unsigned char *p,rec_char;

	size_t md_size, orig_len;

	size_t md_size;

	int npad;

	int t;
@@ -755,10 +755,6 @@ int n_ssl3_mac(SSL *ssl, unsigned char *md, int send) 
	md_size=t;

	npad=(48/md_size)*md_size;



	/* kludge: ssl3_cbc_remove_padding passes padding length in rec->type */

	orig_len = rec->length+md_size+((unsigned int)rec->type>>8);

	rec->type &= 0xff;



	if (!send &&

	    EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE &&

	    ssl3_cbc_record_digest_supported(hash))
@@ -790,7 +786,7 @@ int n_ssl3_mac(SSL *ssl, unsigned char *md, int send) 
			hash,

			md, &md_size,

			header, rec->input,

			rec->length + md_size, orig_len,

			rec->length + md_size, rec->orig_len,

			mac_sec, md_size,

			1 /* is SSLv3 */);

		}

ssl/s3_pkt.c

+6 −6
Original line number Diff line number Diff line
@@ -290,7 +290,7 @@ static int ssl3_get_record(SSL *s) 
	unsigned char *p;

	unsigned char md[EVP_MAX_MD_SIZE];

	short version;

	unsigned mac_size, orig_len;

	unsigned mac_size;

	size_t extra;



	rr= &(s->s3->rrec);
@@ -400,7 +400,7 @@ fprintf(stderr, "Record type=%d, Length=%d\n", rr->type, rr->length); 


	/* decrypt in place in 'rr->input' */

	rr->data=rr->input;

	orig_len=rr->length;

	rr->orig_len=rr->length;



	enc_err = s->method->ssl3_enc->enc(s,0);

	/* enc_err is:
@@ -436,10 +436,10 @@ printf("\n"); 
		 * therefore we can safely process the record in a different

		 * amount of time if it's too short to possibly contain a MAC.

		 */

		if (orig_len < mac_size ||

		if (rr->orig_len < mac_size ||

		    /* CBC records must have a padding length byte too. */

		    (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&

		     orig_len < mac_size+1))

		     rr->orig_len < mac_size+1))

			{

			al=SSL_AD_DECODE_ERROR;

			SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT);
@@ -454,12 +454,12 @@ printf("\n"); 
			 * without leaking the contents of the padding bytes.

			 * */

			mac = mac_tmp;

			ssl3_cbc_copy_mac(mac_tmp, rr, mac_size, orig_len);

			ssl3_cbc_copy_mac(mac_tmp, rr, mac_size);

			rr->length -= mac_size;

			}

		else

			{

			/* In this case there's no padding, so |orig_len|

			/* In this case there's no padding, so |rec->orig_len|

			 * equals |rec->length| and we checked that there's

			 * enough bytes for |mac_size| above. */

			rr->length -= mac_size;

ssl/ssl3.h

+4 −0
Original line number Diff line number Diff line
@@ -366,6 +366,10 @@ typedef struct ssl3_record_st 
	{

/*r */	int type;               /* type of record */

/*rw*/	unsigned int length;    /* How many bytes available */

/*rw*/	unsigned int orig_len;  /* How many bytes were available before padding

				   was removed? This is used to implement the

				   MAC check in constant time for CBC records.

				 */

/*r */	unsigned int off;       /* read/write offset into 'buf' */

/*rw*/	unsigned char *data;    /* pointer to the record data */

/*rw*/	unsigned char *input;   /* where the decode bytes are */