|
 |
c4366c |
diff -up openssl-fips-0.9.8e/crypto/cryptlib.c.lucky13 openssl-fips-0.9.8e/crypto/cryptlib.c
|
|
 |
c4366c |
--- openssl-fips-0.9.8e/crypto/cryptlib.c.lucky13 2007-07-26 18:46:54.000000000 +0200
|
|
 |
c4366c |
+++ openssl-fips-0.9.8e/crypto/cryptlib.c 2013-02-25 14:56:11.392381859 +0100
|
|
 |
c4366c |
@@ -543,3 +543,16 @@ void OpenSSLDie(const char *file,int lin
|
|
 |
c4366c |
}
|
|
 |
c4366c |
|
|
 |
c4366c |
void *OPENSSL_stderr(void) { return stderr; }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+int CRYPTO_memcmp(const void *in_a, const void *in_b, size_t len)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ size_t i;
|
|
 |
c4366c |
+ const unsigned char *a = in_a;
|
|
 |
c4366c |
+ const unsigned char *b = in_b;
|
|
 |
c4366c |
+ unsigned char x = 0;
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ for (i = 0; i < len; i++)
|
|
 |
c4366c |
+ x |= a[i] ^ b[i];
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ return x;
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
diff -up openssl-fips-0.9.8e/crypto/crypto.h.lucky13 openssl-fips-0.9.8e/crypto/crypto.h
|
|
 |
c4366c |
--- openssl-fips-0.9.8e/crypto/crypto.h.lucky13 2013-02-25 14:56:11.049380949 +0100
|
|
 |
c4366c |
+++ openssl-fips-0.9.8e/crypto/crypto.h 2013-02-25 14:56:11.393381862 +0100
|
|
 |
c4366c |
@@ -592,6 +592,13 @@ unsigned long *OPENSSL_ia32cap_loc(void)
|
|
 |
c4366c |
|
|
 |
c4366c |
#endif /* def OPENSSL_FIPS */
|
|
 |
c4366c |
|
|
 |
c4366c |
+/* CRYPTO_memcmp returns zero iff the |len| bytes at |a| and |b| are equal. It
|
|
 |
c4366c |
+ * takes an amount of time dependent on |len|, but independent of the contents
|
|
 |
c4366c |
+ * of |a| and |b|. Unlike memcmp, it cannot be used to put elements into a
|
|
 |
c4366c |
+ * defined order as the return value when a != b is undefined, other than to be
|
|
 |
c4366c |
+ * non-zero. */
|
|
 |
c4366c |
+int CRYPTO_memcmp(const void *a, const void *b, size_t len);
|
|
 |
c4366c |
+
|
|
 |
c4366c |
/* BEGIN ERROR CODES */
|
|
 |
c4366c |
/* The following lines are auto generated by the script mkerr.pl. Any changes
|
|
 |
c4366c |
* made after this point may be overwritten when the script is next run.
|
|
 |
c4366c |
diff -up openssl-fips-0.9.8e/crypto/rsa/rsa_oaep.c.lucky13 openssl-fips-0.9.8e/crypto/rsa/rsa_oaep.c
|
|
 |
c4366c |
--- openssl-fips-0.9.8e/crypto/rsa/rsa_oaep.c.lucky13 2007-03-22 01:38:34.000000000 +0100
|
|
 |
c4366c |
+++ openssl-fips-0.9.8e/crypto/rsa/rsa_oaep.c 2013-02-25 14:56:11.394381865 +0100
|
|
 |
c4366c |
@@ -136,7 +136,7 @@ int RSA_padding_check_PKCS1_OAEP(unsigne
|
|
 |
c4366c |
|
|
 |
c4366c |
EVP_Digest((void *)param, plen, phash, NULL, EVP_sha1(), NULL);
|
|
 |
c4366c |
|
|
 |
c4366c |
- if (memcmp(db, phash, SHA_DIGEST_LENGTH) != 0 || bad)
|
|
 |
c4366c |
+ if (CRYPTO_memcmp(db, phash, SHA_DIGEST_LENGTH) != 0 || bad)
|
|
 |
c4366c |
goto decoding_err;
|
|
 |
c4366c |
else
|
|
 |
c4366c |
{
|
|
 |
c4366c |
diff -up openssl-fips-0.9.8e/ssl/d1_enc.c.lucky13 openssl-fips-0.9.8e/ssl/d1_enc.c
|
|
 |
c4366c |
--- openssl-fips-0.9.8e/ssl/d1_enc.c.lucky13 2013-02-25 14:56:11.374381809 +0100
|
|
 |
c4366c |
+++ openssl-fips-0.9.8e/ssl/d1_enc.c 2013-02-25 14:56:11.395381868 +0100
|
|
 |
c4366c |
@@ -122,18 +122,30 @@
|
|
 |
c4366c |
#include <openssl/rand.h>
|
|
 |
c4366c |
|
|
 |
c4366c |
|
|
 |
c4366c |
+/* dtls1_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * Returns:
|
|
 |
c4366c |
+ * 0: (in non-constant time) if the record is publically invalid (i.e. too
|
|
 |
c4366c |
+ * short etc).
|
|
 |
c4366c |
+ * 1: if the record's padding is valid / the encryption was successful.
|
|
 |
c4366c |
+ * -1: if the record's padding/AEAD-authenticator is invalid or, if sending,
|
|
 |
c4366c |
+ * an internal error occured. */
|
|
 |
c4366c |
int dtls1_enc(SSL *s, int send)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
SSL3_RECORD *rec;
|
|
 |
c4366c |
EVP_CIPHER_CTX *ds;
|
|
 |
c4366c |
unsigned long l;
|
|
 |
c4366c |
- int bs,i,ii,j,k,n=0;
|
|
 |
c4366c |
+ int bs,i,j,k,mac_size=0;
|
|
 |
c4366c |
const EVP_CIPHER *enc;
|
|
 |
c4366c |
|
|
 |
c4366c |
if (send)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
- if (s->write_hash != NULL)
|
|
 |
c4366c |
- n=EVP_MD_size(s->write_hash);
|
|
 |
c4366c |
+ if (s->write_hash)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ mac_size=EVP_MD_size(s->write_hash);
|
|
 |
c4366c |
+ if (mac_size < 0)
|
|
 |
c4366c |
+ return -1;
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
ds=s->enc_write_ctx;
|
|
 |
c4366c |
rec= &(s->s3->wrec);
|
|
 |
c4366c |
if (s->enc_write_ctx == NULL)
|
|
 |
c4366c |
@@ -147,15 +159,18 @@ int dtls1_enc(SSL *s, int send)
|
|
 |
c4366c |
__FILE__, __LINE__);
|
|
 |
c4366c |
else if ( EVP_CIPHER_block_size(ds->cipher) > 1)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
- if (!RAND_bytes(rec->input, EVP_CIPHER_block_size(ds->cipher)))
|
|
 |
c4366c |
+ if (RAND_bytes(rec->input, EVP_CIPHER_block_size(ds->cipher)) <= 0)
|
|
 |
c4366c |
return -1;
|
|
 |
c4366c |
}
|
|
 |
c4366c |
}
|
|
 |
c4366c |
}
|
|
 |
c4366c |
else
|
|
 |
c4366c |
{
|
|
 |
c4366c |
- if (s->read_hash != NULL)
|
|
 |
c4366c |
- n=EVP_MD_size(s->read_hash);
|
|
 |
c4366c |
+ if (s->read_hash)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ mac_size=EVP_MD_size(s->read_hash);
|
|
 |
c4366c |
+ OPENSSL_assert(mac_size >= 0);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
ds=s->enc_read_ctx;
|
|
 |
c4366c |
rec= &(s->s3->rrec);
|
|
 |
c4366c |
if (s->enc_read_ctx == NULL)
|
|
 |
c4366c |
@@ -219,11 +234,7 @@ int dtls1_enc(SSL *s, int send)
|
|
 |
c4366c |
if (!send)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
if (l == 0 || l%bs != 0)
|
|
 |
c4366c |
- {
|
|
 |
c4366c |
- SSLerr(SSL_F_DTLS1_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
|
|
 |
c4366c |
- ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED);
|
|
 |
c4366c |
return 0;
|
|
 |
c4366c |
- }
|
|
 |
c4366c |
}
|
|
 |
c4366c |
|
|
 |
c4366c |
EVP_Cipher(ds,rec->data,rec->input,l);
|
|
 |
c4366c |
@@ -238,43 +249,7 @@ int dtls1_enc(SSL *s, int send)
|
|
 |
c4366c |
#endif /* KSSL_DEBUG */
|
|
 |
c4366c |
|
|
 |
c4366c |
if ((bs != 1) && !send)
|
|
 |
c4366c |
- {
|
|
 |
c4366c |
- ii=i=rec->data[l-1]; /* padding_length */
|
|
 |
c4366c |
- i++;
|
|
 |
c4366c |
- if (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG)
|
|
 |
c4366c |
- {
|
|
 |
c4366c |
- /* First packet is even in size, so check */
|
|
 |
c4366c |
- if ((memcmp(s->s3->read_sequence,
|
|
 |
c4366c |
- "\0\0\0\0\0\0\0\0",8) == 0) && !(ii & 1))
|
|
 |
c4366c |
- s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;
|
|
 |
c4366c |
- if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
|
|
 |
c4366c |
- i--;
|
|
 |
c4366c |
- }
|
|
 |
c4366c |
- /* TLS 1.0 does not bound the number of padding bytes by the block size.
|
|
 |
c4366c |
- * All of them must have value 'padding_length'. */
|
|
 |
c4366c |
- if (i + bs > (int)rec->length)
|
|
 |
c4366c |
- {
|
|
 |
c4366c |
- /* Incorrect padding. SSLerr() and ssl3_alert are done
|
|
 |
c4366c |
- * by caller: we don't want to reveal whether this is
|
|
 |
c4366c |
- * a decryption error or a MAC verification failure
|
|
 |
c4366c |
- * (see http://www.openssl.org/~bodo/tls-cbc.txt)
|
|
 |
c4366c |
- */
|
|
 |
c4366c |
- return -1;
|
|
 |
c4366c |
- }
|
|
 |
c4366c |
- for (j=(int)(l-i); j<(int)l; j++)
|
|
 |
c4366c |
- {
|
|
 |
c4366c |
- if (rec->data[j] != ii)
|
|
 |
c4366c |
- {
|
|
 |
c4366c |
- /* Incorrect padding */
|
|
 |
c4366c |
- return -1;
|
|
 |
c4366c |
- }
|
|
 |
c4366c |
- }
|
|
 |
c4366c |
- rec->length-=i;
|
|
 |
c4366c |
-
|
|
 |
c4366c |
- rec->data += bs; /* skip the implicit IV */
|
|
 |
c4366c |
- rec->input += bs;
|
|
 |
c4366c |
- rec->length -= bs;
|
|
 |
c4366c |
- }
|
|
 |
c4366c |
+ return tls1_cbc_remove_padding(s, rec, bs, mac_size);
|
|
 |
c4366c |
}
|
|
 |
c4366c |
return(1);
|
|
 |
c4366c |
}
|
|
 |
c4366c |
diff -up openssl-fips-0.9.8e/ssl/d1_pkt.c.lucky13 openssl-fips-0.9.8e/ssl/d1_pkt.c
|
|
 |
c4366c |
--- openssl-fips-0.9.8e/ssl/d1_pkt.c.lucky13 2013-02-25 14:56:11.278381571 +0100
|
|
 |
c4366c |
+++ openssl-fips-0.9.8e/ssl/d1_pkt.c 2013-02-25 14:56:11.400381882 +0100
|
|
 |
c4366c |
@@ -328,16 +328,12 @@ dtls1_get_buffered_record(SSL *s)
|
|
 |
c4366c |
static int
|
|
 |
c4366c |
dtls1_process_record(SSL *s)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
- int al;
|
|
 |
c4366c |
- int clear=0;
|
|
 |
c4366c |
- int enc_err;
|
|
 |
c4366c |
+ int i,al;
|
|
 |
c4366c |
+ int enc_err;
|
|
 |
c4366c |
SSL_SESSION *sess;
|
|
 |
c4366c |
- SSL3_RECORD *rr;
|
|
 |
c4366c |
- unsigned int mac_size;
|
|
 |
c4366c |
+ SSL3_RECORD *rr;
|
|
 |
c4366c |
+ unsigned int mac_size, orig_len;
|
|
 |
c4366c |
unsigned char md[EVP_MAX_MD_SIZE];
|
|
 |
c4366c |
- int decryption_failed_or_bad_record_mac = 0;
|
|
 |
c4366c |
- unsigned char *mac = NULL;
|
|
 |
c4366c |
-
|
|
 |
c4366c |
|
|
 |
c4366c |
rr= &(s->s3->rrec);
|
|
 |
c4366c |
sess = s->session;
|
|
 |
c4366c |
@@ -369,12 +365,16 @@ dtls1_process_record(SSL *s)
|
|
 |
c4366c |
rr->data=rr->input;
|
|
 |
c4366c |
|
|
 |
c4366c |
enc_err = s->method->ssl3_enc->enc(s,0);
|
|
 |
c4366c |
- if (enc_err <= 0)
|
|
 |
c4366c |
+ /* enc_err is:
|
|
 |
c4366c |
+ * 0: (in non-constant time) if the record is publically invalid.
|
|
 |
c4366c |
+ * 1: if the padding is valid
|
|
 |
c4366c |
+ * -1: if the padding is invalid */
|
|
 |
c4366c |
+ if (enc_err == 0)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
- /* To minimize information leaked via timing, we will always
|
|
 |
c4366c |
- * perform all computations before discarding the message.
|
|
 |
c4366c |
- */
|
|
 |
c4366c |
- decryption_failed_or_bad_record_mac = 1;
|
|
 |
c4366c |
+ /* For DTLS we simply ignore bad packets. */
|
|
 |
c4366c |
+ rr->length = 0;
|
|
 |
c4366c |
+ s->packet_length = 0;
|
|
 |
c4366c |
+ goto err;
|
|
 |
c4366c |
}
|
|
 |
c4366c |
|
|
 |
c4366c |
#ifdef TLS_DEBUG
|
|
 |
c4366c |
@@ -384,41 +384,62 @@ printf("\n");
|
|
 |
c4366c |
#endif
|
|
 |
c4366c |
|
|
 |
c4366c |
/* r->length is now the compressed data plus mac */
|
|
 |
c4366c |
-if ( (sess == NULL) ||
|
|
 |
c4366c |
- (s->enc_read_ctx == NULL) ||
|
|
 |
c4366c |
- (s->read_hash == NULL))
|
|
 |
c4366c |
- clear=1;
|
|
 |
c4366c |
-
|
|
 |
c4366c |
- if (!clear)
|
|
 |
c4366c |
+ if ((sess != NULL) &&
|
|
 |
c4366c |
+ (s->enc_read_ctx != NULL) &&
|
|
 |
c4366c |
+ (s->read_hash != NULL))
|
|
 |
c4366c |
{
|
|
 |
c4366c |
+ /* s->read_hash != NULL => mac_size != -1 */
|
|
 |
c4366c |
+ unsigned char *mac = NULL;
|
|
 |
c4366c |
+ unsigned char mac_tmp[EVP_MAX_MD_SIZE];
|
|
 |
c4366c |
mac_size=EVP_MD_size(s->read_hash);
|
|
 |
c4366c |
+ OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);
|
|
 |
c4366c |
|
|
 |
c4366c |
- if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+mac_size)
|
|
 |
c4366c |
+ /* kludge: *_cbc_remove_padding passes padding length in rr->type */
|
|
 |
c4366c |
+ orig_len = rr->length+((unsigned int)rr->type>>8);
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ /* orig_len is the length of the record before any padding was
|
|
 |
c4366c |
+ * removed. This is public information, as is the MAC in use,
|
|
 |
c4366c |
+ * therefore we can safely process the record in a different
|
|
 |
c4366c |
+ * amount of time if it's too short to possibly contain a MAC.
|
|
 |
c4366c |
+ */
|
|
 |
c4366c |
+ if (orig_len < mac_size ||
|
|
 |
c4366c |
+ /* CBC records must have a padding length byte too. */
|
|
 |
c4366c |
+ (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
|
|
 |
c4366c |
+ orig_len < mac_size+1))
|
|
 |
c4366c |
{
|
|
 |
c4366c |
-#if 0 /* OK only for stream ciphers (then rr->length is visible from ciphertext anyway) */
|
|
 |
c4366c |
- al=SSL_AD_RECORD_OVERFLOW;
|
|
 |
c4366c |
- SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);
|
|
 |
c4366c |
+ al=SSL_AD_DECODE_ERROR;
|
|
 |
c4366c |
+ SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_LENGTH_TOO_SHORT);
|
|
 |
c4366c |
goto f_err;
|
|
 |
c4366c |
-#else
|
|
 |
c4366c |
- decryption_failed_or_bad_record_mac = 1;
|
|
 |
c4366c |
-#endif
|
|
 |
c4366c |
}
|
|
 |
c4366c |
- /* check the MAC for rr->input (it's in mac_size bytes at the tail) */
|
|
 |
c4366c |
- if (rr->length >= mac_size)
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
+ /* We update the length so that the TLS header bytes
|
|
 |
c4366c |
+ * can be constructed correctly but we need to extract
|
|
 |
c4366c |
+ * the MAC in constant time from within the record,
|
|
 |
c4366c |
+ * without leaking the contents of the padding bytes.
|
|
 |
c4366c |
+ * */
|
|
 |
c4366c |
+ mac = mac_tmp;
|
|
 |
c4366c |
+ ssl3_cbc_copy_mac(mac_tmp, rr, mac_size, orig_len);
|
|
 |
c4366c |
rr->length -= mac_size;
|
|
 |
c4366c |
- mac = &rr->data[rr->length];
|
|
 |
c4366c |
}
|
|
 |
c4366c |
else
|
|
 |
c4366c |
- rr->length = 0;
|
|
 |
c4366c |
- s->method->ssl3_enc->mac(s,md,0);
|
|
 |
c4366c |
- if (mac == NULL || memcmp(md, mac, mac_size) != 0)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
- decryption_failed_or_bad_record_mac = 1;
|
|
 |
c4366c |
+ /* In this case there's no padding, so |orig_len|
|
|
 |
c4366c |
+ * equals |rec->length| and we checked that there's
|
|
 |
c4366c |
+ * enough bytes for |mac_size| above. */
|
|
 |
c4366c |
+ rr->length -= mac_size;
|
|
 |
c4366c |
+ mac = &rr->data[rr->length];
|
|
 |
c4366c |
}
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ i=s->method->ssl3_enc->mac(s,md,0 /* not send */);
|
|
 |
c4366c |
+ if (i < 0 || mac == NULL || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0)
|
|
 |
c4366c |
+ enc_err = -1;
|
|
 |
c4366c |
+ if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+mac_size)
|
|
 |
c4366c |
+ enc_err = -1;
|
|
 |
c4366c |
}
|
|
 |
c4366c |
|
|
 |
c4366c |
- if (decryption_failed_or_bad_record_mac)
|
|
 |
c4366c |
+ if (enc_err < 0)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
/* decryption failed, silently discard message */
|
|
 |
c4366c |
rr->length = 0;
|
|
 |
c4366c |
diff -up openssl-fips-0.9.8e/ssl/Makefile.lucky13 openssl-fips-0.9.8e/ssl/Makefile
|
|
 |
c4366c |
--- openssl-fips-0.9.8e/ssl/Makefile.lucky13 2013-02-25 14:56:11.212381386 +0100
|
|
 |
c4366c |
+++ openssl-fips-0.9.8e/ssl/Makefile 2013-02-25 14:56:11.404381893 +0100
|
|
 |
c4366c |
@@ -22,7 +22,7 @@ LIB=$(TOP)/libssl.a
|
|
 |
c4366c |
SHARED_LIB= libssl$(SHLIB_EXT)
|
|
 |
c4366c |
LIBSRC= \
|
|
 |
c4366c |
s2_meth.c s2_srvr.c s2_clnt.c s2_lib.c s2_enc.c s2_pkt.c \
|
|
 |
c4366c |
- s3_meth.c s3_srvr.c s3_clnt.c s3_lib.c s3_enc.c s3_pkt.c s3_both.c \
|
|
 |
c4366c |
+ s3_meth.c s3_srvr.c s3_clnt.c s3_lib.c s3_enc.c s3_pkt.c s3_both.c s3_cbc.c \
|
|
 |
c4366c |
s23_meth.c s23_srvr.c s23_clnt.c s23_lib.c s23_pkt.c \
|
|
 |
c4366c |
t1_meth.c t1_srvr.c t1_clnt.c t1_lib.c t1_enc.c \
|
|
 |
c4366c |
d1_meth.c d1_srvr.c d1_clnt.c d1_lib.c d1_pkt.c \
|
|
 |
c4366c |
@@ -33,7 +33,7 @@ LIBSRC= \
|
|
 |
c4366c |
bio_ssl.c ssl_err.c kssl.c t1_reneg.c
|
|
 |
c4366c |
LIBOBJ= \
|
|
 |
c4366c |
s2_meth.o s2_srvr.o s2_clnt.o s2_lib.o s2_enc.o s2_pkt.o \
|
|
 |
c4366c |
- s3_meth.o s3_srvr.o s3_clnt.o s3_lib.o s3_enc.o s3_pkt.o s3_both.o \
|
|
 |
c4366c |
+ s3_meth.o s3_srvr.o s3_clnt.o s3_lib.o s3_enc.o s3_pkt.o s3_both.o s3_cbc.o \
|
|
 |
c4366c |
s23_meth.o s23_srvr.o s23_clnt.o s23_lib.o s23_pkt.o \
|
|
 |
c4366c |
t1_meth.o t1_srvr.o t1_clnt.o t1_lib.o t1_enc.o \
|
|
 |
c4366c |
d1_meth.o d1_srvr.o d1_clnt.o d1_lib.o d1_pkt.o \
|
|
 |
c4366c |
diff -up openssl-fips-0.9.8e/ssl/s2_clnt.c.lucky13 openssl-fips-0.9.8e/ssl/s2_clnt.c
|
|
 |
c4366c |
--- openssl-fips-0.9.8e/ssl/s2_clnt.c.lucky13 2013-02-25 14:56:11.097381084 +0100
|
|
 |
c4366c |
+++ openssl-fips-0.9.8e/ssl/s2_clnt.c 2013-02-25 14:56:11.404381893 +0100
|
|
 |
c4366c |
@@ -935,7 +935,7 @@ static int get_server_verify(SSL *s)
|
|
 |
c4366c |
s->msg_callback(0, s->version, 0, p, len, s, s->msg_callback_arg); /* SERVER-VERIFY */
|
|
 |
c4366c |
p += 1;
|
|
 |
c4366c |
|
|
 |
c4366c |
- if (memcmp(p,s->s2->challenge,s->s2->challenge_length) != 0)
|
|
 |
c4366c |
+ if (CRYPTO_memcmp(p,s->s2->challenge,s->s2->challenge_length) != 0)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
|
|
 |
c4366c |
SSLerr(SSL_F_GET_SERVER_VERIFY,SSL_R_CHALLENGE_IS_DIFFERENT);
|
|
 |
c4366c |
diff -up openssl-fips-0.9.8e/ssl/s2_pkt.c.lucky13 openssl-fips-0.9.8e/ssl/s2_pkt.c
|
|
 |
c4366c |
--- openssl-fips-0.9.8e/ssl/s2_pkt.c.lucky13 2003-12-27 17:10:30.000000000 +0100
|
|
 |
c4366c |
+++ openssl-fips-0.9.8e/ssl/s2_pkt.c 2013-02-25 14:56:11.405381896 +0100
|
|
 |
c4366c |
@@ -267,8 +267,7 @@ static int ssl2_read_internal(SSL *s, vo
|
|
 |
c4366c |
s->s2->ract_data_length-=mac_size;
|
|
 |
c4366c |
ssl2_mac(s,mac,0);
|
|
 |
c4366c |
s->s2->ract_data_length-=s->s2->padding;
|
|
 |
c4366c |
- if ( (memcmp(mac,s->s2->mac_data,
|
|
 |
c4366c |
- (unsigned int)mac_size) != 0) ||
|
|
 |
c4366c |
+ if ( (CRYPTO_memcmp(mac,s->s2->mac_data,mac_size) != 0) ||
|
|
 |
c4366c |
(s->s2->rlength%EVP_CIPHER_CTX_block_size(s->enc_read_ctx) != 0))
|
|
 |
c4366c |
{
|
|
 |
c4366c |
SSLerr(SSL_F_SSL2_READ_INTERNAL,SSL_R_BAD_MAC_DECODE);
|
|
 |
c4366c |
diff -up openssl-fips-0.9.8e/ssl/s3_both.c.lucky13 openssl-fips-0.9.8e/ssl/s3_both.c
|
|
 |
c4366c |
--- openssl-fips-0.9.8e/ssl/s3_both.c.lucky13 2013-02-25 14:56:11.221381411 +0100
|
|
 |
c4366c |
+++ openssl-fips-0.9.8e/ssl/s3_both.c 2013-02-25 14:56:11.406381899 +0100
|
|
 |
c4366c |
@@ -242,7 +242,7 @@ int ssl3_get_finished(SSL *s, int a, int
|
|
 |
c4366c |
goto f_err;
|
|
 |
c4366c |
}
|
|
 |
c4366c |
|
|
 |
c4366c |
- if (memcmp(p, s->s3->tmp.peer_finish_md, i) != 0)
|
|
 |
c4366c |
+ if (CRYPTO_memcmp(p, s->s3->tmp.peer_finish_md, i) != 0)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
al=SSL_AD_DECRYPT_ERROR;
|
|
 |
c4366c |
SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_DIGEST_CHECK_FAILED);
|
|
 |
c4366c |
diff -up openssl-fips-0.9.8e/ssl/s3_cbc.c.lucky13 openssl-fips-0.9.8e/ssl/s3_cbc.c
|
|
 |
c4366c |
--- openssl-fips-0.9.8e/ssl/s3_cbc.c.lucky13 2013-02-25 14:56:11.407381902 +0100
|
|
 |
c4366c |
+++ openssl-fips-0.9.8e/ssl/s3_cbc.c 2013-02-25 14:56:11.407381902 +0100
|
|
 |
c4366c |
@@ -0,0 +1,783 @@
|
|
 |
c4366c |
+/* ssl/s3_cbc.c */
|
|
 |
c4366c |
+/* ====================================================================
|
|
 |
c4366c |
+ * Copyright (c) 2012 The OpenSSL Project. All rights reserved.
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * Redistribution and use in source and binary forms, with or without
|
|
 |
c4366c |
+ * modification, are permitted provided that the following conditions
|
|
 |
c4366c |
+ * are met:
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * 1. Redistributions of source code must retain the above copyright
|
|
 |
c4366c |
+ * notice, this list of conditions and the following disclaimer.
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * 2. Redistributions in binary form must reproduce the above copyright
|
|
 |
c4366c |
+ * notice, this list of conditions and the following disclaimer in
|
|
 |
c4366c |
+ * the documentation and/or other materials provided with the
|
|
 |
c4366c |
+ * distribution.
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * 3. All advertising materials mentioning features or use of this
|
|
 |
c4366c |
+ * software must display the following acknowledgment:
|
|
 |
c4366c |
+ * "This product includes software developed by the OpenSSL Project
|
|
 |
c4366c |
+ * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
|
 |
c4366c |
+ * endorse or promote products derived from this software without
|
|
 |
c4366c |
+ * prior written permission. For written permission, please contact
|
|
 |
c4366c |
+ * openssl-core@openssl.org.
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * 5. Products derived from this software may not be called "OpenSSL"
|
|
 |
c4366c |
+ * nor may "OpenSSL" appear in their names without prior written
|
|
 |
c4366c |
+ * permission of the OpenSSL Project.
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * 6. Redistributions of any form whatsoever must retain the following
|
|
 |
c4366c |
+ * acknowledgment:
|
|
 |
c4366c |
+ * "This product includes software developed by the OpenSSL Project
|
|
 |
c4366c |
+ * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
|
 |
c4366c |
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
 |
c4366c |
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
|
 |
c4366c |
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
|
 |
c4366c |
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
 |
c4366c |
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
|
 |
c4366c |
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
|
 |
c4366c |
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
 |
c4366c |
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
 |
c4366c |
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
 |
c4366c |
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
|
 |
c4366c |
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
 |
c4366c |
+ * ====================================================================
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * This product includes cryptographic software written by Eric Young
|
|
 |
c4366c |
+ * (eay@cryptsoft.com). This product includes software written by Tim
|
|
 |
c4366c |
+ * Hudson (tjh@cryptsoft.com).
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ */
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+#include "ssl_locl.h"
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+#include <openssl/md5.h>
|
|
 |
c4366c |
+#include <openssl/sha.h>
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+/* MAX_HASH_BIT_COUNT_BYTES is the maximum number of bytes in the hash's length
|
|
 |
c4366c |
+ * field. (SHA-384/512 have 128-bit length.) */
|
|
 |
c4366c |
+#define MAX_HASH_BIT_COUNT_BYTES 16
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+/* MAX_HASH_BLOCK_SIZE is the maximum hash block size that we'll support.
|
|
 |
c4366c |
+ * Currently SHA-384/512 has a 128-byte block size and that's the largest
|
|
 |
c4366c |
+ * supported by TLS.) */
|
|
 |
c4366c |
+#define MAX_HASH_BLOCK_SIZE 128
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+/* Some utility functions are needed:
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * These macros return the given value with the MSB copied to all the other
|
|
 |
c4366c |
+ * bits. They use the fact that arithmetic shift shifts-in the sign bit.
|
|
 |
c4366c |
+ * However, this is not ensured by the C standard so you may need to replace
|
|
 |
c4366c |
+ * them with something else on odd CPUs. */
|
|
 |
c4366c |
+#define DUPLICATE_MSB_TO_ALL(x) ( (unsigned)( (int)(x) >> (sizeof(int)*8-1) ) )
|
|
 |
c4366c |
+#define DUPLICATE_MSB_TO_ALL_8(x) ((unsigned char)(DUPLICATE_MSB_TO_ALL(x)))
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+/* constant_time_lt returns 0xff if a
|
|
 |
c4366c |
+static unsigned constant_time_lt(unsigned a, unsigned b)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ a -= b;
|
|
 |
c4366c |
+ return DUPLICATE_MSB_TO_ALL(a);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+/* constant_time_ge returns 0xff if a>=b and 0x00 otherwise. */
|
|
 |
c4366c |
+static unsigned constant_time_ge(unsigned a, unsigned b)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ a -= b;
|
|
 |
c4366c |
+ return DUPLICATE_MSB_TO_ALL(~a);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+/* constant_time_eq_8 returns 0xff if a==b and 0x00 otherwise. */
|
|
 |
c4366c |
+static unsigned char constant_time_eq_8(unsigned a, unsigned b)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ unsigned c = a ^ b;
|
|
 |
c4366c |
+ c--;
|
|
 |
c4366c |
+ return DUPLICATE_MSB_TO_ALL_8(c);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+/* ssl3_cbc_remove_padding removes padding from the decrypted, SSLv3, CBC
|
|
 |
c4366c |
+ * record in |rec| by updating |rec->length| in constant time.
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * block_size: the block size of the cipher used to encrypt the record.
|
|
 |
c4366c |
+ * returns:
|
|
 |
c4366c |
+ * 0: (in non-constant time) if the record is publicly invalid.
|
|
 |
c4366c |
+ * 1: if the padding was valid
|
|
 |
c4366c |
+ * -1: otherwise. */
|
|
 |
c4366c |
+int ssl3_cbc_remove_padding(const SSL* s,
|
|
 |
c4366c |
+ SSL3_RECORD *rec,
|
|
 |
c4366c |
+ unsigned block_size,
|
|
 |
c4366c |
+ unsigned mac_size)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ unsigned padding_length, good;
|
|
 |
c4366c |
+ const unsigned overhead = 1 /* padding length byte */ + mac_size;
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ /* These lengths are all public so we can test them in non-constant
|
|
 |
c4366c |
+ * time. */
|
|
 |
c4366c |
+ if (overhead > rec->length)
|
|
 |
c4366c |
+ return 0;
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ padding_length = rec->data[rec->length-1];
|
|
 |
c4366c |
+ good = constant_time_ge(rec->length, padding_length+overhead);
|
|
 |
c4366c |
+ /* SSLv3 requires that the padding is minimal. */
|
|
 |
c4366c |
+ good &= constant_time_ge(block_size, padding_length+1);
|
|
 |
c4366c |
+ padding_length = good & (padding_length+1);
|
|
 |
c4366c |
+ rec->length -= padding_length;
|
|
 |
c4366c |
+ rec->type |= padding_length<<8; /* kludge: pass padding length */
|
|
 |
c4366c |
+ return (int)((good & 1) | (~good & -1));
|
|
 |
c4366c |
+}
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+/* tls1_cbc_remove_padding removes the CBC padding from the decrypted, TLS, CBC
|
|
 |
c4366c |
+ * record in |rec| in constant time and returns 1 if the padding is valid and
|
|
 |
c4366c |
+ * -1 otherwise. It also removes any explicit IV from the start of the record
|
|
 |
c4366c |
+ * without leaking any timing about whether there was enough space after the
|
|
 |
c4366c |
+ * padding was removed.
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * block_size: the block size of the cipher used to encrypt the record.
|
|
 |
c4366c |
+ * returns:
|
|
 |
c4366c |
+ * 0: (in non-constant time) if the record is publicly invalid.
|
|
 |
c4366c |
+ * 1: if the padding was valid
|
|
 |
c4366c |
+ * -1: otherwise. */
|
|
 |
c4366c |
+int tls1_cbc_remove_padding(const SSL* s,
|
|
 |
c4366c |
+ SSL3_RECORD *rec,
|
|
 |
c4366c |
+ unsigned block_size,
|
|
 |
c4366c |
+ unsigned mac_size)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ unsigned padding_length, good, to_check, i;
|
|
 |
c4366c |
+ const unsigned overhead = 1 /* padding length byte */ + mac_size;
|
|
 |
c4366c |
+ /* Check if version requires explicit IV */
|
|
 |
c4366c |
+ if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ /* These lengths are all public so we can test them in
|
|
 |
c4366c |
+ * non-constant time.
|
|
 |
c4366c |
+ */
|
|
 |
c4366c |
+ if (overhead + block_size > rec->length)
|
|
 |
c4366c |
+ return 0;
|
|
 |
c4366c |
+ /* We can now safely skip explicit IV */
|
|
 |
c4366c |
+ rec->data += block_size;
|
|
 |
c4366c |
+ rec->input += block_size;
|
|
 |
c4366c |
+ rec->length -= block_size;
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+ else if (overhead > rec->length)
|
|
 |
c4366c |
+ return 0;
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ padding_length = rec->data[rec->length-1];
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ /* NB: if compression is in operation the first packet may not be of
|
|
 |
c4366c |
+ * even length so the padding bug check cannot be performed. This bug
|
|
 |
c4366c |
+ * workaround has been around since SSLeay so hopefully it is either
|
|
 |
c4366c |
+ * fixed now or no buggy implementation supports compression [steve]
|
|
 |
c4366c |
+ */
|
|
 |
c4366c |
+ if ( (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ /* First packet is even in size, so check */
|
|
 |
c4366c |
+ if ((memcmp(s->s3->read_sequence, "\0\0\0\0\0\0\0\0",8) == 0) &&
|
|
 |
c4366c |
+ !(padding_length & 1))
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+ if ((s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG) &&
|
|
 |
c4366c |
+ padding_length > 0)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ padding_length--;
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ good = constant_time_ge(rec->length, overhead+padding_length);
|
|
 |
c4366c |
+ /* The padding consists of a length byte at the end of the record and
|
|
 |
c4366c |
+ * then that many bytes of padding, all with the same value as the
|
|
 |
c4366c |
+ * length byte. Thus, with the length byte included, there are i+1
|
|
 |
c4366c |
+ * bytes of padding.
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * We can't check just |padding_length+1| bytes because that leaks
|
|
 |
c4366c |
+ * decrypted information. Therefore we always have to check the maximum
|
|
 |
c4366c |
+ * amount of padding possible. (Again, the length of the record is
|
|
 |
c4366c |
+ * public information so we can use it.) */
|
|
 |
c4366c |
+ to_check = 255; /* maximum amount of padding. */
|
|
 |
c4366c |
+ if (to_check > rec->length-1)
|
|
 |
c4366c |
+ to_check = rec->length-1;
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ for (i = 0; i < to_check; i++)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ unsigned char mask = constant_time_ge(padding_length, i);
|
|
 |
c4366c |
+ unsigned char b = rec->data[rec->length-1-i];
|
|
 |
c4366c |
+ /* The final |padding_length+1| bytes should all have the value
|
|
 |
c4366c |
+ * |padding_length|. Therefore the XOR should be zero. */
|
|
 |
c4366c |
+ good &= ~(mask&(padding_length ^ b));
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ /* If any of the final |padding_length+1| bytes had the wrong value,
|
|
 |
c4366c |
+ * one or more of the lower eight bits of |good| will be cleared. We
|
|
 |
c4366c |
+ * AND the bottom 8 bits together and duplicate the result to all the
|
|
 |
c4366c |
+ * bits. */
|
|
 |
c4366c |
+ good &= good >> 4;
|
|
 |
c4366c |
+ good &= good >> 2;
|
|
 |
c4366c |
+ good &= good >> 1;
|
|
 |
c4366c |
+ good <<= sizeof(good)*8-1;
|
|
 |
c4366c |
+ good = DUPLICATE_MSB_TO_ALL(good);
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ padding_length = good & (padding_length+1);
|
|
 |
c4366c |
+ rec->length -= padding_length;
|
|
 |
c4366c |
+ rec->type |= padding_length<<8; /* kludge: pass padding length */
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ return (int)((good & 1) | (~good & -1));
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+/* ssl3_cbc_copy_mac copies |md_size| bytes from the end of |rec| to |out| in
|
|
 |
c4366c |
+ * constant time (independent of the concrete value of rec->length, which may
|
|
 |
c4366c |
+ * vary within a 256-byte window).
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * ssl3_cbc_remove_padding or tls1_cbc_remove_padding must be called prior to
|
|
 |
c4366c |
+ * this function.
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * On entry:
|
|
 |
c4366c |
+ * rec->orig_len >= md_size
|
|
 |
c4366c |
+ * md_size <= EVP_MAX_MD_SIZE
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * If CBC_MAC_ROTATE_IN_PLACE is defined then the rotation is performed with
|
|
 |
c4366c |
+ * variable accesses in a 64-byte-aligned buffer. Assuming that this fits into
|
|
 |
c4366c |
+ * a single or pair of cache-lines, then the variable memory accesses don't
|
|
 |
c4366c |
+ * actually affect the timing. CPUs with smaller cache-lines [if any] are
|
|
 |
c4366c |
+ * not multi-core and are not considered vulnerable to cache-timing attacks.
|
|
 |
c4366c |
+ */
|
|
 |
c4366c |
+#define CBC_MAC_ROTATE_IN_PLACE
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+void ssl3_cbc_copy_mac(unsigned char* out,
|
|
 |
c4366c |
+ const SSL3_RECORD *rec,
|
|
 |
c4366c |
+ unsigned md_size,unsigned orig_len)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+#if defined(CBC_MAC_ROTATE_IN_PLACE)
|
|
 |
c4366c |
+ unsigned char rotated_mac_buf[64+EVP_MAX_MD_SIZE];
|
|
 |
c4366c |
+ unsigned char *rotated_mac;
|
|
 |
c4366c |
+#else
|
|
 |
c4366c |
+ unsigned char rotated_mac[EVP_MAX_MD_SIZE];
|
|
 |
c4366c |
+#endif
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ /* mac_end is the index of |rec->data| just after the end of the MAC. */
|
|
 |
c4366c |
+ unsigned mac_end = rec->length;
|
|
 |
c4366c |
+ unsigned mac_start = mac_end - md_size;
|
|
 |
c4366c |
+ /* scan_start contains the number of bytes that we can ignore because
|
|
 |
c4366c |
+ * the MAC's position can only vary by 255 bytes. */
|
|
 |
c4366c |
+ unsigned scan_start = 0;
|
|
 |
c4366c |
+ unsigned i, j;
|
|
 |
c4366c |
+ unsigned div_spoiler;
|
|
 |
c4366c |
+ unsigned rotate_offset;
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ OPENSSL_assert(orig_len >= md_size);
|
|
 |
c4366c |
+ OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE);
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+#if defined(CBC_MAC_ROTATE_IN_PLACE)
|
|
 |
c4366c |
+ rotated_mac = rotated_mac_buf + ((0-(size_t)rotated_mac_buf)&63);
|
|
 |
c4366c |
+#endif
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ /* This information is public so it's safe to branch based on it. */
|
|
 |
c4366c |
+ if (orig_len > md_size + 255 + 1)
|
|
 |
c4366c |
+ scan_start = orig_len - (md_size + 255 + 1);
|
|
 |
c4366c |
+ /* div_spoiler contains a multiple of md_size that is used to cause the
|
|
 |
c4366c |
+ * modulo operation to be constant time. Without this, the time varies
|
|
 |
c4366c |
+ * based on the amount of padding when running on Intel chips at least.
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * The aim of right-shifting md_size is so that the compiler doesn't
|
|
 |
c4366c |
+ * figure out that it can remove div_spoiler as that would require it
|
|
 |
c4366c |
+ * to prove that md_size is always even, which I hope is beyond it. */
|
|
 |
c4366c |
+ div_spoiler = md_size >> 1;
|
|
 |
c4366c |
+ div_spoiler <<= (sizeof(div_spoiler)-1)*8;
|
|
 |
c4366c |
+ rotate_offset = (div_spoiler + mac_start - scan_start) % md_size;
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ memset(rotated_mac, 0, md_size);
|
|
 |
c4366c |
+ for (i = scan_start, j = 0; i < orig_len; i++)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ unsigned char mac_started = constant_time_ge(i, mac_start);
|
|
 |
c4366c |
+ unsigned char mac_ended = constant_time_ge(i, mac_end);
|
|
 |
c4366c |
+ unsigned char b = rec->data[i];
|
|
 |
c4366c |
+ rotated_mac[j++] |= b & mac_started & ~mac_ended;
|
|
 |
c4366c |
+ j &= constant_time_lt(j,md_size);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ /* Now rotate the MAC */
|
|
 |
c4366c |
+#if defined(CBC_MAC_ROTATE_IN_PLACE)
|
|
 |
c4366c |
+ j = 0;
|
|
 |
c4366c |
+ for (i = 0; i < md_size; i++)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ /* in case cache-line is 32 bytes, touch second line */
|
|
 |
c4366c |
+ ((volatile unsigned char *)rotated_mac)[rotate_offset^32];
|
|
 |
c4366c |
+ out[j++] = rotated_mac[rotate_offset++];
|
|
 |
c4366c |
+ rotate_offset &= constant_time_lt(rotate_offset,md_size);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+#else
|
|
 |
c4366c |
+ memset(out, 0, md_size);
|
|
 |
c4366c |
+ rotate_offset = md_size - rotate_offset;
|
|
 |
c4366c |
+ rotate_offset &= constant_time_lt(rotate_offset,md_size);
|
|
 |
c4366c |
+ for (i = 0; i < md_size; i++)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ for (j = 0; j < md_size; j++)
|
|
 |
c4366c |
+ out[j] |= rotated_mac[i] & constant_time_eq_8(j, rotate_offset);
|
|
 |
c4366c |
+ rotate_offset++;
|
|
 |
c4366c |
+ rotate_offset &= constant_time_lt(rotate_offset,md_size);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+#endif
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+/* u32toLE serialises an unsigned, 32-bit number (n) as four bytes at (p) in
|
|
 |
c4366c |
+ * little-endian order. The value of p is advanced by four. */
|
|
 |
c4366c |
+#define u32toLE(n, p) \
|
|
 |
c4366c |
+ (*((p)++)=(unsigned char)(n), \
|
|
 |
c4366c |
+ *((p)++)=(unsigned char)(n>>8), \
|
|
 |
c4366c |
+ *((p)++)=(unsigned char)(n>>16), \
|
|
 |
c4366c |
+ *((p)++)=(unsigned char)(n>>24))
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+/* These functions serialize the state of a hash and thus perform the standard
|
|
 |
c4366c |
+ * "final" operation without adding the padding and length that such a function
|
|
 |
c4366c |
+ * typically does. */
|
|
 |
c4366c |
+static void tls1_md5_final_raw(void* ctx, unsigned char *md_out)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ MD5_CTX *md5 = ctx;
|
|
 |
c4366c |
+ u32toLE(md5->A, md_out);
|
|
 |
c4366c |
+ u32toLE(md5->B, md_out);
|
|
 |
c4366c |
+ u32toLE(md5->C, md_out);
|
|
 |
c4366c |
+ u32toLE(md5->D, md_out);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+static void tls1_sha1_final_raw(void* ctx, unsigned char *md_out)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ SHA_CTX *sha1 = ctx;
|
|
 |
c4366c |
+ l2n(sha1->h0, md_out);
|
|
 |
c4366c |
+ l2n(sha1->h1, md_out);
|
|
 |
c4366c |
+ l2n(sha1->h2, md_out);
|
|
 |
c4366c |
+ l2n(sha1->h3, md_out);
|
|
 |
c4366c |
+ l2n(sha1->h4, md_out);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+#define LARGEST_DIGEST_CTX SHA_CTX
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+#ifndef OPENSSL_NO_SHA256
|
|
 |
c4366c |
+static void tls1_sha256_final_raw(void* ctx, unsigned char *md_out)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ SHA256_CTX *sha256 = ctx;
|
|
 |
c4366c |
+ unsigned i;
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ for (i = 0; i < 8; i++)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ l2n(sha256->h[i], md_out);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+#undef LARGEST_DIGEST_CTX
|
|
 |
c4366c |
+#define LARGEST_DIGEST_CTX SHA256_CTX
|
|
 |
c4366c |
+#endif
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+#ifndef OPENSSL_NO_SHA512
|
|
 |
c4366c |
+static void tls1_sha512_final_raw(void* ctx, unsigned char *md_out)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ SHA512_CTX *sha512 = ctx;
|
|
 |
c4366c |
+ unsigned i;
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ for (i = 0; i < 8; i++)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ l2n8(sha512->h[i], md_out);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+#undef LARGEST_DIGEST_CTX
|
|
 |
c4366c |
+#define LARGEST_DIGEST_CTX SHA512_CTX
|
|
 |
c4366c |
+#endif
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+/* ssl3_cbc_record_digest_supported returns 1 iff |ctx| uses a hash function
|
|
 |
c4366c |
+ * which ssl3_cbc_digest_record supports. */
|
|
 |
c4366c |
+char ssl3_cbc_record_digest_supported(const EVP_MD *digest)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+#ifdef OPENSSL_FIPS
|
|
 |
c4366c |
+ if (FIPS_mode())
|
|
 |
c4366c |
+ return 0;
|
|
 |
c4366c |
+#endif
|
|
 |
c4366c |
+ switch (EVP_MD_type(digest))
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ case NID_md5:
|
|
 |
c4366c |
+ case NID_sha1:
|
|
 |
c4366c |
+#ifndef OPENSSL_NO_SHA256
|
|
 |
c4366c |
+ case NID_sha224:
|
|
 |
c4366c |
+ case NID_sha256:
|
|
 |
c4366c |
+#endif
|
|
 |
c4366c |
+#ifndef OPENSSL_NO_SHA512
|
|
 |
c4366c |
+ case NID_sha384:
|
|
 |
c4366c |
+ case NID_sha512:
|
|
 |
c4366c |
+#endif
|
|
 |
c4366c |
+ return 1;
|
|
 |
c4366c |
+ default:
|
|
 |
c4366c |
+ return 0;
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+/* ssl3_cbc_digest_record computes the MAC of a decrypted, padded SSLv3/TLS
|
|
 |
c4366c |
+ * record.
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * ctx: the EVP_MD_CTX from which we take the hash function.
|
|
 |
c4366c |
+ * ssl3_cbc_record_digest_supported must return true for this EVP_MD_CTX.
|
|
 |
c4366c |
+ * md_out: the digest output. At most EVP_MAX_MD_SIZE bytes will be written.
|
|
 |
c4366c |
+ * md_out_size: if non-NULL, the number of output bytes is written here.
|
|
 |
c4366c |
+ * header: the 13-byte, TLS record header.
|
|
 |
c4366c |
+ * data: the record data itself, less any preceeding explicit IV.
|
|
 |
c4366c |
+ * data_plus_mac_size: the secret, reported length of the data and MAC
|
|
 |
c4366c |
+ * once the padding has been removed.
|
|
 |
c4366c |
+ * data_plus_mac_plus_padding_size: the public length of the whole
|
|
 |
c4366c |
+ * record, including padding.
|
|
 |
c4366c |
+ * is_sslv3: non-zero if we are to use SSLv3. Otherwise, TLS.
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * On entry: by virtue of having been through one of the remove_padding
|
|
 |
c4366c |
+ * functions, above, we know that data_plus_mac_size is large enough to contain
|
|
 |
c4366c |
+ * a padding byte and MAC. (If the padding was invalid, it might contain the
|
|
 |
c4366c |
+ * padding too. ) */
|
|
 |
c4366c |
+void ssl3_cbc_digest_record(
|
|
 |
c4366c |
+ const EVP_MD *digest,
|
|
 |
c4366c |
+ unsigned char* md_out,
|
|
 |
c4366c |
+ size_t* md_out_size,
|
|
 |
c4366c |
+ const unsigned char header[13],
|
|
 |
c4366c |
+ const unsigned char *data,
|
|
 |
c4366c |
+ size_t data_plus_mac_size,
|
|
 |
c4366c |
+ size_t data_plus_mac_plus_padding_size,
|
|
 |
c4366c |
+ const unsigned char *mac_secret,
|
|
 |
c4366c |
+ unsigned mac_secret_length,
|
|
 |
c4366c |
+ char is_sslv3)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ union { double align;
|
|
 |
c4366c |
+ unsigned char c[sizeof(LARGEST_DIGEST_CTX)]; } md_state;
|
|
 |
c4366c |
+ void (*md_final_raw)(void *ctx, unsigned char *md_out);
|
|
 |
c4366c |
+ void (*md_transform)(void *ctx, const unsigned char *block);
|
|
 |
c4366c |
+ unsigned md_size, md_block_size = 64;
|
|
 |
c4366c |
+ unsigned sslv3_pad_length = 40, header_length, variance_blocks,
|
|
 |
c4366c |
+ len, max_mac_bytes, num_blocks,
|
|
 |
c4366c |
+ num_starting_blocks, k, mac_end_offset, c, index_a, index_b;
|
|
 |
c4366c |
+ unsigned int bits; /* at most 18 bits */
|
|
 |
c4366c |
+ unsigned char length_bytes[MAX_HASH_BIT_COUNT_BYTES];
|
|
 |
c4366c |
+ /* hmac_pad is the masked HMAC key. */
|
|
 |
c4366c |
+ unsigned char hmac_pad[MAX_HASH_BLOCK_SIZE];
|
|
 |
c4366c |
+ unsigned char first_block[MAX_HASH_BLOCK_SIZE];
|
|
 |
c4366c |
+ unsigned char mac_out[EVP_MAX_MD_SIZE];
|
|
 |
c4366c |
+ unsigned i, j, md_out_size_u;
|
|
 |
c4366c |
+ EVP_MD_CTX md_ctx;
|
|
 |
c4366c |
+ /* mdLengthSize is the number of bytes in the length field that terminates
|
|
 |
c4366c |
+ * the hash. */
|
|
 |
c4366c |
+ unsigned md_length_size = 8;
|
|
 |
c4366c |
+ char length_is_big_endian = 1;
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ /* This is a, hopefully redundant, check that allows us to forget about
|
|
 |
c4366c |
+ * many possible overflows later in this function. */
|
|
 |
c4366c |
+ OPENSSL_assert(data_plus_mac_plus_padding_size < 1024*1024);
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ switch (EVP_MD_type(digest))
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ case NID_md5:
|
|
 |
c4366c |
+ MD5_Init((MD5_CTX*)md_state.c);
|
|
 |
c4366c |
+ md_final_raw = tls1_md5_final_raw;
|
|
 |
c4366c |
+ md_transform = (void(*)(void *ctx, const unsigned char *block)) MD5_Transform;
|
|
 |
c4366c |
+ md_size = 16;
|
|
 |
c4366c |
+ sslv3_pad_length = 48;
|
|
 |
c4366c |
+ length_is_big_endian = 0;
|
|
 |
c4366c |
+ break;
|
|
 |
c4366c |
+ case NID_sha1:
|
|
 |
c4366c |
+ SHA1_Init((SHA_CTX*)md_state.c);
|
|
 |
c4366c |
+ md_final_raw = tls1_sha1_final_raw;
|
|
 |
c4366c |
+ md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA1_Transform;
|
|
 |
c4366c |
+ md_size = 20;
|
|
 |
c4366c |
+ break;
|
|
 |
c4366c |
+#ifndef OPENSSL_NO_SHA256
|
|
 |
c4366c |
+ case NID_sha224:
|
|
 |
c4366c |
+ SHA224_Init((SHA256_CTX*)md_state.c);
|
|
 |
c4366c |
+ md_final_raw = tls1_sha256_final_raw;
|
|
 |
c4366c |
+ md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA256_Transform;
|
|
 |
c4366c |
+ md_size = 224/8;
|
|
 |
c4366c |
+ break;
|
|
 |
c4366c |
+ case NID_sha256:
|
|
 |
c4366c |
+ SHA256_Init((SHA256_CTX*)md_state.c);
|
|
 |
c4366c |
+ md_final_raw = tls1_sha256_final_raw;
|
|
 |
c4366c |
+ md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA256_Transform;
|
|
 |
c4366c |
+ md_size = 32;
|
|
 |
c4366c |
+ break;
|
|
 |
c4366c |
+#endif
|
|
 |
c4366c |
+#ifndef OPENSSL_NO_SHA512
|
|
 |
c4366c |
+ case NID_sha384:
|
|
 |
c4366c |
+ SHA384_Init((SHA512_CTX*)md_state.c);
|
|
 |
c4366c |
+ md_final_raw = tls1_sha512_final_raw;
|
|
 |
c4366c |
+ md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA512_Transform;
|
|
 |
c4366c |
+ md_size = 384/8;
|
|
 |
c4366c |
+ md_block_size = 128;
|
|
 |
c4366c |
+ md_length_size = 16;
|
|
 |
c4366c |
+ break;
|
|
 |
c4366c |
+ case NID_sha512:
|
|
 |
c4366c |
+ SHA512_Init((SHA512_CTX*)md_state.c);
|
|
 |
c4366c |
+ md_final_raw = tls1_sha512_final_raw;
|
|
 |
c4366c |
+ md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA512_Transform;
|
|
 |
c4366c |
+ md_size = 64;
|
|
 |
c4366c |
+ md_block_size = 128;
|
|
 |
c4366c |
+ md_length_size = 16;
|
|
 |
c4366c |
+ break;
|
|
 |
c4366c |
+#endif
|
|
 |
c4366c |
+ default:
|
|
 |
c4366c |
+ /* ssl3_cbc_record_digest_supported should have been
|
|
 |
c4366c |
+ * called first to check that the hash function is
|
|
 |
c4366c |
+ * supported. */
|
|
 |
c4366c |
+ OPENSSL_assert(0);
|
|
 |
c4366c |
+ if (md_out_size)
|
|
 |
c4366c |
+ *md_out_size = -1;
|
|
 |
c4366c |
+ return;
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ OPENSSL_assert(md_length_size <= MAX_HASH_BIT_COUNT_BYTES);
|
|
 |
c4366c |
+ OPENSSL_assert(md_block_size <= MAX_HASH_BLOCK_SIZE);
|
|
 |
c4366c |
+ OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE);
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ header_length = 13;
|
|
 |
c4366c |
+ if (is_sslv3)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ header_length =
|
|
 |
c4366c |
+ mac_secret_length +
|
|
 |
c4366c |
+ sslv3_pad_length +
|
|
 |
c4366c |
+ 8 /* sequence number */ +
|
|
 |
c4366c |
+ 1 /* record type */ +
|
|
 |
c4366c |
+ 2 /* record length */;
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ /* variance_blocks is the number of blocks of the hash that we have to
|
|
 |
c4366c |
+ * calculate in constant time because they could be altered by the
|
|
 |
c4366c |
+ * padding value.
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * In SSLv3, the padding must be minimal so the end of the plaintext
|
|
 |
c4366c |
+ * varies by, at most, 15+20 = 35 bytes. (We conservatively assume that
|
|
 |
c4366c |
+ * the MAC size varies from 0..20 bytes.) In case the 9 bytes of hash
|
|
 |
c4366c |
+ * termination (0x80 + 64-bit length) don't fit in the final block, we
|
|
 |
c4366c |
+ * say that the final two blocks can vary based on the padding.
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * TLSv1 has MACs up to 48 bytes long (SHA-384) and the padding is not
|
|
 |
c4366c |
+ * required to be minimal. Therefore we say that the final six blocks
|
|
 |
c4366c |
+ * can vary based on the padding.
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * Later in the function, if the message is short and there obviously
|
|
 |
c4366c |
+ * cannot be this many blocks then variance_blocks can be reduced. */
|
|
 |
c4366c |
+ variance_blocks = is_sslv3 ? 2 : 6;
|
|
 |
c4366c |
+ /* From now on we're dealing with the MAC, which conceptually has 13
|
|
 |
c4366c |
+ * bytes of `header' before the start of the data (TLS) or 71/75 bytes
|
|
 |
c4366c |
+ * (SSLv3) */
|
|
 |
c4366c |
+ len = data_plus_mac_plus_padding_size + header_length;
|
|
 |
c4366c |
+ /* max_mac_bytes contains the maximum bytes of bytes in the MAC, including
|
|
 |
c4366c |
+ * |header|, assuming that there's no padding. */
|
|
 |
c4366c |
+ max_mac_bytes = len - md_size - 1;
|
|
 |
c4366c |
+ /* num_blocks is the maximum number of hash blocks. */
|
|
 |
c4366c |
+ num_blocks = (max_mac_bytes + 1 + md_length_size + md_block_size - 1) / md_block_size;
|
|
 |
c4366c |
+ /* In order to calculate the MAC in constant time we have to handle
|
|
 |
c4366c |
+ * the final blocks specially because the padding value could cause the
|
|
 |
c4366c |
+ * end to appear somewhere in the final |variance_blocks| blocks and we
|
|
 |
c4366c |
+ * can't leak where. However, |num_starting_blocks| worth of data can
|
|
 |
c4366c |
+ * be hashed right away because no padding value can affect whether
|
|
 |
c4366c |
+ * they are plaintext. */
|
|
 |
c4366c |
+ num_starting_blocks = 0;
|
|
 |
c4366c |
+ /* k is the starting byte offset into the conceptual header||data where
|
|
 |
c4366c |
+ * we start processing. */
|
|
 |
c4366c |
+ k = 0;
|
|
 |
c4366c |
+ /* mac_end_offset is the index just past the end of the data to be
|
|
 |
c4366c |
+ * MACed. */
|
|
 |
c4366c |
+ mac_end_offset = data_plus_mac_size + header_length - md_size;
|
|
 |
c4366c |
+ /* c is the index of the 0x80 byte in the final hash block that
|
|
 |
c4366c |
+ * contains application data. */
|
|
 |
c4366c |
+ c = mac_end_offset % md_block_size;
|
|
 |
c4366c |
+ /* index_a is the hash block number that contains the 0x80 terminating
|
|
 |
c4366c |
+ * value. */
|
|
 |
c4366c |
+ index_a = mac_end_offset / md_block_size;
|
|
 |
c4366c |
+ /* index_b is the hash block number that contains the 64-bit hash
|
|
 |
c4366c |
+ * length, in bits. */
|
|
 |
c4366c |
+ index_b = (mac_end_offset + md_length_size) / md_block_size;
|
|
 |
c4366c |
+ /* bits is the hash-length in bits. It includes the additional hash
|
|
 |
c4366c |
+ * block for the masked HMAC key, or whole of |header| in the case of
|
|
 |
c4366c |
+ * SSLv3. */
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ /* For SSLv3, if we're going to have any starting blocks then we need
|
|
 |
c4366c |
+ * at least two because the header is larger than a single block. */
|
|
 |
c4366c |
+ if (num_blocks > variance_blocks + (is_sslv3 ? 1 : 0))
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ num_starting_blocks = num_blocks - variance_blocks;
|
|
 |
c4366c |
+ k = md_block_size*num_starting_blocks;
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ bits = 8*mac_end_offset;
|
|
 |
c4366c |
+ if (!is_sslv3)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ /* Compute the initial HMAC block. For SSLv3, the padding and
|
|
 |
c4366c |
+ * secret bytes are included in |header| because they take more
|
|
 |
c4366c |
+ * than a single block. */
|
|
 |
c4366c |
+ bits += 8*md_block_size;
|
|
 |
c4366c |
+ memset(hmac_pad, 0, md_block_size);
|
|
 |
c4366c |
+ OPENSSL_assert(mac_secret_length <= sizeof(hmac_pad));
|
|
 |
c4366c |
+ memcpy(hmac_pad, mac_secret, mac_secret_length);
|
|
 |
c4366c |
+ for (i = 0; i < md_block_size; i++)
|
|
 |
c4366c |
+ hmac_pad[i] ^= 0x36;
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ md_transform(md_state.c, hmac_pad);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ if (length_is_big_endian)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ memset(length_bytes,0,md_length_size-4);
|
|
 |
c4366c |
+ length_bytes[md_length_size-4] = (unsigned char)(bits>>24);
|
|
 |
c4366c |
+ length_bytes[md_length_size-3] = (unsigned char)(bits>>16);
|
|
 |
c4366c |
+ length_bytes[md_length_size-2] = (unsigned char)(bits>>8);
|
|
 |
c4366c |
+ length_bytes[md_length_size-1] = (unsigned char)bits;
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+ else
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ memset(length_bytes,0,md_length_size);
|
|
 |
c4366c |
+ length_bytes[md_length_size-5] = (unsigned char)(bits>>24);
|
|
 |
c4366c |
+ length_bytes[md_length_size-6] = (unsigned char)(bits>>16);
|
|
 |
c4366c |
+ length_bytes[md_length_size-7] = (unsigned char)(bits>>8);
|
|
 |
c4366c |
+ length_bytes[md_length_size-8] = (unsigned char)bits;
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ if (k > 0)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ if (is_sslv3)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ /* The SSLv3 header is larger than a single block.
|
|
 |
c4366c |
+ * overhang is the number of bytes beyond a single
|
|
 |
c4366c |
+ * block that the header consumes: either 7 bytes
|
|
 |
c4366c |
+ * (SHA1) or 11 bytes (MD5). */
|
|
 |
c4366c |
+ unsigned overhang = header_length-md_block_size;
|
|
 |
c4366c |
+ md_transform(md_state.c, header);
|
|
 |
c4366c |
+ memcpy(first_block, header + md_block_size, overhang);
|
|
 |
c4366c |
+ memcpy(first_block + overhang, data, md_block_size-overhang);
|
|
 |
c4366c |
+ md_transform(md_state.c, first_block);
|
|
 |
c4366c |
+ for (i = 1; i < k/md_block_size - 1; i++)
|
|
 |
c4366c |
+ md_transform(md_state.c, data + md_block_size*i - overhang);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+ else
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ /* k is a multiple of md_block_size. */
|
|
 |
c4366c |
+ memcpy(first_block, header, 13);
|
|
 |
c4366c |
+ memcpy(first_block+13, data, md_block_size-13);
|
|
 |
c4366c |
+ md_transform(md_state.c, first_block);
|
|
 |
c4366c |
+ for (i = 1; i < k/md_block_size; i++)
|
|
 |
c4366c |
+ md_transform(md_state.c, data + md_block_size*i - 13);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ memset(mac_out, 0, sizeof(mac_out));
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ /* We now process the final hash blocks. For each block, we construct
|
|
 |
c4366c |
+ * it in constant time. If the |i==index_a| then we'll include the 0x80
|
|
 |
c4366c |
+ * bytes and zero pad etc. For each block we selectively copy it, in
|
|
 |
c4366c |
+ * constant time, to |mac_out|. */
|
|
 |
c4366c |
+ for (i = num_starting_blocks; i <= num_starting_blocks+variance_blocks; i++)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ unsigned char block[MAX_HASH_BLOCK_SIZE];
|
|
 |
c4366c |
+ unsigned char is_block_a = constant_time_eq_8(i, index_a);
|
|
 |
c4366c |
+ unsigned char is_block_b = constant_time_eq_8(i, index_b);
|
|
 |
c4366c |
+ for (j = 0; j < md_block_size; j++)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ unsigned char b = 0, is_past_c, is_past_cp1;
|
|
 |
c4366c |
+ if (k < header_length)
|
|
 |
c4366c |
+ b = header[k];
|
|
 |
c4366c |
+ else if (k < data_plus_mac_plus_padding_size + header_length)
|
|
 |
c4366c |
+ b = data[k-header_length];
|
|
 |
c4366c |
+ k++;
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ is_past_c = is_block_a & constant_time_ge(j, c);
|
|
 |
c4366c |
+ is_past_cp1 = is_block_a & constant_time_ge(j, c+1);
|
|
 |
c4366c |
+ /* If this is the block containing the end of the
|
|
 |
c4366c |
+ * application data, and we are at the offset for the
|
|
 |
c4366c |
+ * 0x80 value, then overwrite b with 0x80. */
|
|
 |
c4366c |
+ b = (b&~is_past_c) | (0x80&is_past_c);
|
|
 |
c4366c |
+ /* If this the the block containing the end of the
|
|
 |
c4366c |
+ * application data and we're past the 0x80 value then
|
|
 |
c4366c |
+ * just write zero. */
|
|
 |
c4366c |
+ b = b&~is_past_cp1;
|
|
 |
c4366c |
+ /* If this is index_b (the final block), but not
|
|
 |
c4366c |
+ * index_a (the end of the data), then the 64-bit
|
|
 |
c4366c |
+ * length didn't fit into index_a and we're having to
|
|
 |
c4366c |
+ * add an extra block of zeros. */
|
|
 |
c4366c |
+ b &= ~is_block_b | is_block_a;
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ /* The final bytes of one of the blocks contains the
|
|
 |
c4366c |
+ * length. */
|
|
 |
c4366c |
+ if (j >= md_block_size - md_length_size)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ /* If this is index_b, write a length byte. */
|
|
 |
c4366c |
+ b = (b&~is_block_b) | (is_block_b&length_bytes[j-(md_block_size-md_length_size)]);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+ block[j] = b;
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ md_transform(md_state.c, block);
|
|
 |
c4366c |
+ md_final_raw(md_state.c, block);
|
|
 |
c4366c |
+ /* If this is index_b, copy the hash value to |mac_out|. */
|
|
 |
c4366c |
+ for (j = 0; j < md_size; j++)
|
|
 |
c4366c |
+ mac_out[j] |= block[j]&is_block_b;
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ EVP_MD_CTX_init(&md_ctx);
|
|
 |
c4366c |
+ EVP_DigestInit_ex(&md_ctx, digest, NULL /* engine */);
|
|
 |
c4366c |
+ if (is_sslv3)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ /* We repurpose |hmac_pad| to contain the SSLv3 pad2 block. */
|
|
 |
c4366c |
+ memset(hmac_pad, 0x5c, sslv3_pad_length);
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ EVP_DigestUpdate(&md_ctx, mac_secret, mac_secret_length);
|
|
 |
c4366c |
+ EVP_DigestUpdate(&md_ctx, hmac_pad, sslv3_pad_length);
|
|
 |
c4366c |
+ EVP_DigestUpdate(&md_ctx, mac_out, md_size);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+ else
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ /* Complete the HMAC in the standard manner. */
|
|
 |
c4366c |
+ for (i = 0; i < md_block_size; i++)
|
|
 |
c4366c |
+ hmac_pad[i] ^= 0x6a;
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ EVP_DigestUpdate(&md_ctx, hmac_pad, md_block_size);
|
|
 |
c4366c |
+ EVP_DigestUpdate(&md_ctx, mac_out, md_size);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+ EVP_DigestFinal(&md_ctx, md_out, &md_out_size_u);
|
|
 |
c4366c |
+ if (md_out_size)
|
|
 |
c4366c |
+ *md_out_size = md_out_size_u;
|
|
 |
c4366c |
+ EVP_MD_CTX_cleanup(&md_ctx);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+#ifdef OPENSSL_FIPS
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+/* Due to the need to use EVP in FIPS mode we can't reimplement digests but
|
|
 |
c4366c |
+ * we can ensure the number of blocks processed is equal for all cases
|
|
 |
c4366c |
+ * by digesting additional data.
|
|
 |
c4366c |
+ */
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+void tls_fips_digest_extra(
|
|
 |
c4366c |
+ const EVP_CIPHER_CTX *cipher_ctx, const EVP_MD *hash, HMAC_CTX *hctx,
|
|
 |
c4366c |
+ const unsigned char *data, size_t data_len, size_t orig_len)
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ size_t block_size, digest_pad, blocks_data, blocks_orig;
|
|
 |
c4366c |
+ if (EVP_CIPHER_CTX_mode(cipher_ctx) != EVP_CIPH_CBC_MODE)
|
|
 |
c4366c |
+ return;
|
|
 |
c4366c |
+ block_size = EVP_MD_block_size(hash);
|
|
 |
c4366c |
+ /* We are in FIPS mode if we get this far so we know we have only SHA*
|
|
 |
c4366c |
+ * digests and TLS to deal with.
|
|
 |
c4366c |
+ * Minimum digest padding length is 17 for SHA384/SHA512 and 9
|
|
 |
c4366c |
+ * otherwise.
|
|
 |
c4366c |
+ * Additional header is 13 bytes. To get the number of digest blocks
|
|
 |
c4366c |
+ * processed round up the amount of data plus padding to the nearest
|
|
 |
c4366c |
+ * block length. Block length is 128 for SHA384/SHA512 and 64 otherwise.
|
|
 |
c4366c |
+ * So we have:
|
|
 |
c4366c |
+ * blocks = (payload_len + digest_pad + 13 + block_size - 1)/block_size
|
|
 |
c4366c |
+ * equivalently:
|
|
 |
c4366c |
+ * blocks = (payload_len + digest_pad + 12)/block_size + 1
|
|
 |
c4366c |
+ * HMAC adds a constant overhead.
|
|
 |
c4366c |
+ * We're ultimately only interested in differences so this becomes
|
|
 |
c4366c |
+ * blocks = (payload_len + 29)/128
|
|
 |
c4366c |
+ * for SHA384/SHA512 and
|
|
 |
c4366c |
+ * blocks = (payload_len + 21)/64
|
|
 |
c4366c |
+ * otherwise.
|
|
 |
c4366c |
+ */
|
|
 |
c4366c |
+ digest_pad = block_size == 64 ? 21 : 29;
|
|
 |
c4366c |
+ blocks_orig = (orig_len + digest_pad)/block_size;
|
|
 |
c4366c |
+ blocks_data = (data_len + digest_pad)/block_size;
|
|
 |
c4366c |
+ /* MAC enough blocks to make up the difference between the original
|
|
 |
c4366c |
+ * and actual lengths plus one extra block to ensure this is never a
|
|
 |
c4366c |
+ * no op. The "data" pointer should always have enough space to
|
|
 |
c4366c |
+ * perform this operation as it is large enough for a maximum
|
|
 |
c4366c |
+ * length TLS buffer.
|
|
 |
c4366c |
+ */
|
|
 |
c4366c |
+ HMAC_Update(hctx, data,
|
|
 |
c4366c |
+ (blocks_orig - blocks_data + 1) * block_size);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+#endif
|
|
 |
c4366c |
diff -up openssl-fips-0.9.8e/ssl/s3_enc.c.lucky13 openssl-fips-0.9.8e/ssl/s3_enc.c
|
|
 |
c4366c |
--- openssl-fips-0.9.8e/ssl/s3_enc.c.lucky13 2013-02-25 14:56:11.285381591 +0100
|
|
 |
c4366c |
+++ openssl-fips-0.9.8e/ssl/s3_enc.c 2013-02-25 14:56:11.407381902 +0100
|
|
 |
c4366c |
@@ -434,12 +434,21 @@ void ssl3_cleanup_key_block(SSL *s)
|
|
 |
c4366c |
s->s3->tmp.key_block_length=0;
|
|
 |
c4366c |
}
|
|
 |
c4366c |
|
|
 |
c4366c |
+/* ssl3_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * Returns:
|
|
 |
c4366c |
+ * 0: (in non-constant time) if the record is publically invalid (i.e. too
|
|
 |
c4366c |
+ * short etc).
|
|
 |
c4366c |
+ * 1: if the record's padding is valid / the encryption was successful.
|
|
 |
c4366c |
+ * -1: if the record's padding is invalid or, if sending, an internal error
|
|
 |
c4366c |
+ * occured.
|
|
 |
c4366c |
+ */
|
|
 |
c4366c |
int ssl3_enc(SSL *s, int send)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
SSL3_RECORD *rec;
|
|
 |
c4366c |
EVP_CIPHER_CTX *ds;
|
|
 |
c4366c |
unsigned long l;
|
|
 |
c4366c |
- int bs,i;
|
|
 |
c4366c |
+ int bs,i,mac_size=0;
|
|
 |
c4366c |
const EVP_CIPHER *enc;
|
|
 |
c4366c |
|
|
 |
c4366c |
if (send)
|
|
 |
c4366c |
@@ -490,32 +499,17 @@ int ssl3_enc(SSL *s, int send)
|
|
 |
c4366c |
if (!send)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
if (l == 0 || l%bs != 0)
|
|
 |
c4366c |
- {
|
|
 |
c4366c |
- SSLerr(SSL_F_SSL3_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
|
|
 |
c4366c |
- ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED);
|
|
 |
c4366c |
return 0;
|
|
 |
c4366c |
- }
|
|
 |
c4366c |
/* otherwise, rec->length >= bs */
|
|
 |
c4366c |
}
|
|
 |
c4366c |
|
|
 |
c4366c |
EVP_Cipher(ds,rec->data,rec->input,l);
|
|
 |
c4366c |
|
|
 |
c4366c |
+ if (s->read_hash != NULL)
|
|
 |
c4366c |
+ mac_size = EVP_MD_size(s->read_hash);
|
|
 |
c4366c |
+
|
|
 |
c4366c |
if ((bs != 1) && !send)
|
|
 |
c4366c |
- {
|
|
 |
c4366c |
- i=rec->data[l-1]+1;
|
|
 |
c4366c |
- /* SSL 3.0 bounds the number of padding bytes by the block size;
|
|
 |
c4366c |
- * padding bytes (except the last one) are arbitrary */
|
|
 |
c4366c |
- if (i > bs)
|
|
 |
c4366c |
- {
|
|
 |
c4366c |
- /* Incorrect padding. SSLerr() and ssl3_alert are done
|
|
 |
c4366c |
- * by caller: we don't want to reveal whether this is
|
|
 |
c4366c |
- * a decryption error or a MAC verification failure
|
|
 |
c4366c |
- * (see http://www.openssl.org/~bodo/tls-cbc.txt) */
|
|
 |
c4366c |
- return -1;
|
|
 |
c4366c |
- }
|
|
 |
c4366c |
- /* now i <= bs <= rec->length */
|
|
 |
c4366c |
- rec->length-=i;
|
|
 |
c4366c |
- }
|
|
 |
c4366c |
+ return ssl3_cbc_remove_padding(s, rec, bs, mac_size);
|
|
 |
c4366c |
}
|
|
 |
c4366c |
return(1);
|
|
 |
c4366c |
}
|
|
 |
c4366c |
@@ -592,7 +586,7 @@ int ssl3_mac(SSL *ssl, unsigned char *md
|
|
 |
c4366c |
EVP_MD_CTX md_ctx;
|
|
 |
c4366c |
const EVP_MD *hash;
|
|
 |
c4366c |
unsigned char *p,rec_char;
|
|
 |
c4366c |
- unsigned int md_size;
|
|
 |
c4366c |
+ size_t md_size, orig_len;
|
|
 |
c4366c |
int npad;
|
|
 |
c4366c |
|
|
 |
c4366c |
if (send)
|
|
 |
c4366c |
@@ -613,28 +607,72 @@ int ssl3_mac(SSL *ssl, unsigned char *md
|
|
 |
c4366c |
md_size=EVP_MD_size(hash);
|
|
 |
c4366c |
npad=(48/md_size)*md_size;
|
|
 |
c4366c |
|
|
 |
c4366c |
- /* Chop the digest off the end :-) */
|
|
 |
c4366c |
- EVP_MD_CTX_init(&md_ctx);
|
|
 |
c4366c |
-
|
|
 |
c4366c |
- EVP_DigestInit_ex( &md_ctx,hash, NULL);
|
|
 |
c4366c |
- EVP_DigestUpdate(&md_ctx,mac_sec,md_size);
|
|
 |
c4366c |
- EVP_DigestUpdate(&md_ctx,ssl3_pad_1,npad);
|
|
 |
c4366c |
- EVP_DigestUpdate(&md_ctx,seq,8);
|
|
 |
c4366c |
- rec_char=rec->type;
|
|
 |
c4366c |
- EVP_DigestUpdate(&md_ctx,&rec_char,1);
|
|
 |
c4366c |
- p=md;
|
|
 |
c4366c |
- s2n(rec->length,p);
|
|
 |
c4366c |
- EVP_DigestUpdate(&md_ctx,md,2);
|
|
 |
c4366c |
- EVP_DigestUpdate(&md_ctx,rec->input,rec->length);
|
|
 |
c4366c |
- EVP_DigestFinal_ex( &md_ctx,md,NULL);
|
|
 |
c4366c |
-
|
|
 |
c4366c |
- EVP_DigestInit_ex( &md_ctx,hash, NULL);
|
|
 |
c4366c |
- EVP_DigestUpdate(&md_ctx,mac_sec,md_size);
|
|
 |
c4366c |
- EVP_DigestUpdate(&md_ctx,ssl3_pad_2,npad);
|
|
 |
c4366c |
- EVP_DigestUpdate(&md_ctx,md,md_size);
|
|
 |
c4366c |
- EVP_DigestFinal_ex( &md_ctx,md,&md_size);
|
|
 |
c4366c |
+ /* kludge: ssl3_cbc_remove_padding passes padding length in rec->type */
|
|
 |
c4366c |
+ orig_len = rec->length+md_size+((unsigned int)rec->type>>8);
|
|
 |
c4366c |
+ rec->type &= 0xff;
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ if (!send &&
|
|
 |
c4366c |
+ EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
|
|
 |
c4366c |
+ ssl3_cbc_record_digest_supported(hash))
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ /* This is a CBC-encrypted record. We must avoid leaking any
|
|
 |
c4366c |
+ * timing-side channel information about how many blocks of
|
|
 |
c4366c |
+ * data we are hashing because that gives an attacker a
|
|
 |
c4366c |
+ * timing-oracle. */
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ /* npad is, at most, 48 bytes and that's with MD5:
|
|
 |
c4366c |
+ * 16 + 48 + 8 (sequence bytes) + 1 + 2 = 75.
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * With SHA-1 (the largest hash speced for SSLv3) the hash size
|
|
 |
c4366c |
+ * goes up 4, but npad goes down by 8, resulting in a smaller
|
|
 |
c4366c |
+ * total size. */
|
|
 |
c4366c |
+ unsigned char header[75];
|
|
 |
c4366c |
+ unsigned j = 0;
|
|
 |
c4366c |
+ memcpy(header+j, mac_sec, md_size);
|
|
 |
c4366c |
+ j += md_size;
|
|
 |
c4366c |
+ memcpy(header+j, ssl3_pad_1, npad);
|
|
 |
c4366c |
+ j += npad;
|
|
 |
c4366c |
+ memcpy(header+j, seq, 8);
|
|
 |
c4366c |
+ j += 8;
|
|
 |
c4366c |
+ header[j++] = rec->type;
|
|
 |
c4366c |
+ header[j++] = rec->length >> 8;
|
|
 |
c4366c |
+ header[j++] = rec->length & 0xff;
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ ssl3_cbc_digest_record(
|
|
 |
c4366c |
+ hash,
|
|
 |
c4366c |
+ md, &md_size,
|
|
 |
c4366c |
+ header, rec->input,
|
|
 |
c4366c |
+ rec->length + md_size, orig_len,
|
|
 |
c4366c |
+ mac_sec, md_size,
|
|
 |
c4366c |
+ 1 /* is SSLv3 */);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+ else
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ unsigned int md_size_u;
|
|
 |
c4366c |
+ /* Chop the digest off the end :-) */
|
|
 |
c4366c |
+ EVP_MD_CTX_init(&md_ctx);
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ EVP_DigestInit_ex( &md_ctx,hash, NULL);
|
|
 |
c4366c |
+ EVP_DigestUpdate(&md_ctx,mac_sec,md_size);
|
|
 |
c4366c |
+ EVP_DigestUpdate(&md_ctx,ssl3_pad_1,npad);
|
|
 |
c4366c |
+ EVP_DigestUpdate(&md_ctx,seq,8);
|
|
 |
c4366c |
+ rec_char=rec->type;
|
|
 |
c4366c |
+ EVP_DigestUpdate(&md_ctx,&rec_char,1);
|
|
 |
c4366c |
+ p=md;
|
|
 |
c4366c |
+ s2n(rec->length,p);
|
|
 |
c4366c |
+ EVP_DigestUpdate(&md_ctx,md,2);
|
|
 |
c4366c |
+ EVP_DigestUpdate(&md_ctx,rec->input,rec->length);
|
|
 |
c4366c |
+ EVP_DigestFinal_ex( &md_ctx,md,NULL);
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ EVP_DigestInit_ex( &md_ctx,hash, NULL);
|
|
 |
c4366c |
+ EVP_DigestUpdate(&md_ctx,mac_sec,md_size);
|
|
 |
c4366c |
+ EVP_DigestUpdate(&md_ctx,ssl3_pad_2,npad);
|
|
 |
c4366c |
+ EVP_DigestUpdate(&md_ctx,md,md_size);
|
|
 |
c4366c |
+ EVP_DigestFinal_ex( &md_ctx,md,&md_size_u);
|
|
 |
c4366c |
+ md_size = md_size_u;
|
|
 |
c4366c |
|
|
 |
c4366c |
- EVP_MD_CTX_cleanup(&md_ctx);
|
|
 |
c4366c |
+ EVP_MD_CTX_cleanup(&md_ctx);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
|
|
 |
c4366c |
ssl3_record_sequence_update(seq);
|
|
 |
c4366c |
return(md_size);
|
|
 |
c4366c |
diff -up openssl-fips-0.9.8e/ssl/s3_pkt.c.lucky13 openssl-fips-0.9.8e/ssl/s3_pkt.c
|
|
 |
c4366c |
--- openssl-fips-0.9.8e/ssl/s3_pkt.c.lucky13 2013-02-25 14:56:11.225381423 +0100
|
|
 |
c4366c |
+++ openssl-fips-0.9.8e/ssl/s3_pkt.c 2013-02-25 14:56:11.408381905 +0100
|
|
 |
c4366c |
@@ -237,11 +237,8 @@ static int ssl3_get_record(SSL *s)
|
|
 |
c4366c |
unsigned char *p;
|
|
 |
c4366c |
unsigned char md[EVP_MAX_MD_SIZE];
|
|
 |
c4366c |
short version;
|
|
 |
c4366c |
- unsigned int mac_size;
|
|
 |
c4366c |
- int clear=0;
|
|
 |
c4366c |
+ unsigned mac_size, orig_len;
|
|
 |
c4366c |
size_t extra;
|
|
 |
c4366c |
- int decryption_failed_or_bad_record_mac = 0;
|
|
 |
c4366c |
- unsigned char *mac = NULL;
|
|
 |
c4366c |
|
|
 |
c4366c |
rr= &(s->s3->rrec);
|
|
 |
c4366c |
sess=s->session;
|
|
 |
c4366c |
@@ -347,17 +344,15 @@ again:
|
|
 |
c4366c |
rr->data=rr->input;
|
|
 |
c4366c |
|
|
 |
c4366c |
enc_err = s->method->ssl3_enc->enc(s,0);
|
|
 |
c4366c |
- if (enc_err <= 0)
|
|
 |
c4366c |
+ /* enc_err is:
|
|
 |
c4366c |
+ * 0: (in non-constant time) if the record is publically invalid.
|
|
 |
c4366c |
+ * 1: if the padding is valid
|
|
 |
c4366c |
+ * -1: if the padding is invalid */
|
|
 |
c4366c |
+ if (enc_err == 0)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
- if (enc_err == 0)
|
|
 |
c4366c |
- /* SSLerr() and ssl3_send_alert() have been called */
|
|
 |
c4366c |
- goto err;
|
|
 |
c4366c |
-
|
|
 |
c4366c |
- /* Otherwise enc_err == -1, which indicates bad padding
|
|
 |
c4366c |
- * (rec->length has not been changed in this case).
|
|
 |
c4366c |
- * To minimize information leaked via timing, we will perform
|
|
 |
c4366c |
- * the MAC computation anyway. */
|
|
 |
c4366c |
- decryption_failed_or_bad_record_mac = 1;
|
|
 |
c4366c |
+ al=SSL_AD_DECRYPTION_FAILED;
|
|
 |
c4366c |
+ SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
|
|
 |
c4366c |
+ goto f_err;
|
|
 |
c4366c |
}
|
|
 |
c4366c |
|
|
 |
c4366c |
#ifdef TLS_DEBUG
|
|
 |
c4366c |
@@ -367,51 +362,62 @@ printf("\n");
|
|
 |
c4366c |
#endif
|
|
 |
c4366c |
|
|
 |
c4366c |
/* r->length is now the compressed data plus mac */
|
|
 |
c4366c |
- if ( (sess == NULL) ||
|
|
 |
c4366c |
- (s->enc_read_ctx == NULL) ||
|
|
 |
c4366c |
- (s->read_hash == NULL))
|
|
 |
c4366c |
- clear=1;
|
|
 |
c4366c |
-
|
|
 |
c4366c |
- if (!clear)
|
|
 |
c4366c |
- {
|
|
 |
c4366c |
+ if ((sess != NULL) &&
|
|
 |
c4366c |
+ (s->enc_read_ctx != NULL) &&
|
|
 |
c4366c |
+ (s->read_hash != NULL))
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ /* s->read_hash != NULL => mac_size != -1 */
|
|
 |
c4366c |
+ unsigned char *mac = NULL;
|
|
 |
c4366c |
+ unsigned char mac_tmp[EVP_MAX_MD_SIZE];
|
|
 |
c4366c |
mac_size=EVP_MD_size(s->read_hash);
|
|
 |
c4366c |
+ OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);
|
|
 |
c4366c |
|
|
 |
c4366c |
- if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra+mac_size)
|
|
 |
c4366c |
+ /* kludge: *_cbc_remove_padding passes padding length in rr->type */
|
|
 |
c4366c |
+ orig_len = rr->length+((unsigned int)rr->type>>8);
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ /* orig_len is the length of the record before any padding was
|
|
 |
c4366c |
+ * removed. This is public information, as is the MAC in use,
|
|
 |
c4366c |
+ * therefore we can safely process the record in a different
|
|
 |
c4366c |
+ * amount of time if it's too short to possibly contain a MAC.
|
|
 |
c4366c |
+ */
|
|
 |
c4366c |
+ if (orig_len < mac_size ||
|
|
 |
c4366c |
+ /* CBC records must have a padding length byte too. */
|
|
 |
c4366c |
+ (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
|
|
 |
c4366c |
+ orig_len < mac_size+1))
|
|
 |
c4366c |
{
|
|
 |
c4366c |
-#if 0 /* OK only for stream ciphers (then rr->length is visible from ciphertext anyway) */
|
|
 |
c4366c |
- al=SSL_AD_RECORD_OVERFLOW;
|
|
 |
c4366c |
- SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);
|
|
 |
c4366c |
+ al=SSL_AD_DECODE_ERROR;
|
|
 |
c4366c |
+ SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT);
|
|
 |
c4366c |
goto f_err;
|
|
 |
c4366c |
-#else
|
|
 |
c4366c |
- decryption_failed_or_bad_record_mac = 1;
|
|
 |
c4366c |
-#endif
|
|
 |
c4366c |
}
|
|
 |
c4366c |
- /* check the MAC for rr->input (it's in mac_size bytes at the tail) */
|
|
 |
c4366c |
- if (rr->length >= mac_size)
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
+ /* We update the length so that the TLS header bytes
|
|
 |
c4366c |
+ * can be constructed correctly but we need to extract
|
|
 |
c4366c |
+ * the MAC in constant time from within the record,
|
|
 |
c4366c |
+ * without leaking the contents of the padding bytes.
|
|
 |
c4366c |
+ * */
|
|
 |
c4366c |
+ mac = mac_tmp;
|
|
 |
c4366c |
+ ssl3_cbc_copy_mac(mac_tmp, rr, mac_size, orig_len);
|
|
 |
c4366c |
rr->length -= mac_size;
|
|
 |
c4366c |
- mac = &rr->data[rr->length];
|
|
 |
c4366c |
}
|
|
 |
c4366c |
else
|
|
 |
c4366c |
{
|
|
 |
c4366c |
- /* record (minus padding) is too short to contain a MAC */
|
|
 |
c4366c |
-#if 0 /* OK only for stream ciphers */
|
|
 |
c4366c |
- al=SSL_AD_DECODE_ERROR;
|
|
 |
c4366c |
- SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT);
|
|
 |
c4366c |
- goto f_err;
|
|
 |
c4366c |
-#else
|
|
 |
c4366c |
- decryption_failed_or_bad_record_mac = 1;
|
|
 |
c4366c |
- rr->length = 0;
|
|
 |
c4366c |
-#endif
|
|
 |
c4366c |
- }
|
|
 |
c4366c |
- i=s->method->ssl3_enc->mac(s,md,0);
|
|
 |
c4366c |
- if (mac == NULL || memcmp(md, mac, mac_size) != 0)
|
|
 |
c4366c |
- {
|
|
 |
c4366c |
- decryption_failed_or_bad_record_mac = 1;
|
|
 |
c4366c |
+ /* In this case there's no padding, so |orig_len|
|
|
 |
c4366c |
+ * equals |rec->length| and we checked that there's
|
|
 |
c4366c |
+ * enough bytes for |mac_size| above. */
|
|
 |
c4366c |
+ rr->length -= mac_size;
|
|
 |
c4366c |
+ mac = &rr->data[rr->length];
|
|
 |
c4366c |
}
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ i=s->method->ssl3_enc->mac(s,md,0 /* not send */);
|
|
 |
c4366c |
+ if (i < 0 || mac == NULL || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0)
|
|
 |
c4366c |
+ enc_err = -1;
|
|
 |
c4366c |
+ if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra+mac_size)
|
|
 |
c4366c |
+ enc_err = -1;
|
|
 |
c4366c |
}
|
|
 |
c4366c |
|
|
 |
c4366c |
- if (decryption_failed_or_bad_record_mac)
|
|
 |
c4366c |
+ if (enc_err < 0)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
/* A separate 'decryption_failed' alert was introduced with TLS 1.0,
|
|
 |
c4366c |
* SSL 3.0 only has 'bad_record_mac'. But unless a decryption
|
|
 |
c4366c |
diff -up openssl-fips-0.9.8e/ssl/ssl_locl.h.lucky13 openssl-fips-0.9.8e/ssl/ssl_locl.h
|
|
 |
c4366c |
--- openssl-fips-0.9.8e/ssl/ssl_locl.h.lucky13 2013-02-25 14:56:11.219381406 +0100
|
|
 |
c4366c |
+++ openssl-fips-0.9.8e/ssl/ssl_locl.h 2013-02-25 14:57:27.348538698 +0100
|
|
 |
c4366c |
@@ -133,6 +133,7 @@
|
|
 |
c4366c |
#ifndef OPENSSL_NO_DSA
|
|
 |
c4366c |
#include <openssl/dsa.h>
|
|
 |
c4366c |
#endif
|
|
 |
c4366c |
+#include <openssl/hmac.h>
|
|
 |
c4366c |
#include <openssl/err.h>
|
|
 |
c4366c |
#include <openssl/ssl.h>
|
|
 |
c4366c |
#include <openssl/symhacks.h>
|
|
 |
c4366c |
@@ -187,6 +188,15 @@
|
|
 |
c4366c |
*((c)++)=(unsigned char)(((l)>> 8)&0xff), \
|
|
 |
c4366c |
*((c)++)=(unsigned char)(((l) )&0xff))
|
|
 |
c4366c |
|
|
 |
c4366c |
+#define l2n8(l,c) (*((c)++)=(unsigned char)(((l)>>56)&0xff), \
|
|
 |
c4366c |
+ *((c)++)=(unsigned char)(((l)>>48)&0xff), \
|
|
 |
c4366c |
+ *((c)++)=(unsigned char)(((l)>>40)&0xff), \
|
|
 |
c4366c |
+ *((c)++)=(unsigned char)(((l)>>32)&0xff), \
|
|
 |
c4366c |
+ *((c)++)=(unsigned char)(((l)>>24)&0xff), \
|
|
 |
c4366c |
+ *((c)++)=(unsigned char)(((l)>>16)&0xff), \
|
|
 |
c4366c |
+ *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
|
|
 |
c4366c |
+ *((c)++)=(unsigned char)(((l) )&0xff))
|
|
 |
c4366c |
+
|
|
 |
c4366c |
#define n2l6(c,l) (l =((BN_ULLONG)(*((c)++)))<<40, \
|
|
 |
c4366c |
l|=((BN_ULLONG)(*((c)++)))<<32, \
|
|
 |
c4366c |
l|=((BN_ULLONG)(*((c)++)))<<24, \
|
|
 |
c4366c |
@@ -946,5 +956,33 @@ int ssl_add_clienthello_renegotiate_ext(
|
|
 |
c4366c |
int maxlen);
|
|
 |
c4366c |
int ssl_parse_clienthello_renegotiate_ext(SSL *s, unsigned char *d, int len,
|
|
 |
c4366c |
int *al);
|
|
 |
c4366c |
+/* s3_cbc.c */
|
|
 |
c4366c |
+void ssl3_cbc_copy_mac(unsigned char* out,
|
|
 |
c4366c |
+ const SSL3_RECORD *rec,
|
|
 |
c4366c |
+ unsigned md_size,unsigned orig_len);
|
|
 |
c4366c |
+int ssl3_cbc_remove_padding(const SSL* s,
|
|
 |
c4366c |
+ SSL3_RECORD *rec,
|
|
 |
c4366c |
+ unsigned block_size,
|
|
 |
c4366c |
+ unsigned mac_size);
|
|
 |
c4366c |
+int tls1_cbc_remove_padding(const SSL* s,
|
|
 |
c4366c |
+ SSL3_RECORD *rec,
|
|
 |
c4366c |
+ unsigned block_size,
|
|
 |
c4366c |
+ unsigned mac_size);
|
|
 |
c4366c |
+char ssl3_cbc_record_digest_supported(const EVP_MD *hash);
|
|
 |
c4366c |
+void ssl3_cbc_digest_record(
|
|
 |
c4366c |
+ const EVP_MD *hash,
|
|
 |
c4366c |
+ unsigned char* md_out,
|
|
 |
c4366c |
+ size_t* md_out_size,
|
|
 |
c4366c |
+ const unsigned char header[13],
|
|
 |
c4366c |
+ const unsigned char *data,
|
|
 |
c4366c |
+ size_t data_plus_mac_size,
|
|
 |
c4366c |
+ size_t data_plus_mac_plus_padding_size,
|
|
 |
c4366c |
+ const unsigned char *mac_secret,
|
|
 |
c4366c |
+ unsigned mac_secret_length,
|
|
 |
c4366c |
+ char is_sslv3);
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+void tls_fips_digest_extra(
|
|
 |
c4366c |
+ const EVP_CIPHER_CTX *cipher_ctx, const EVP_MD *hash, HMAC_CTX *hctx,
|
|
 |
c4366c |
+ const unsigned char *data, size_t data_len, size_t orig_len);
|
|
 |
c4366c |
|
|
 |
c4366c |
#endif
|
|
 |
c4366c |
diff -up openssl-fips-0.9.8e/ssl/t1_enc.c.lucky13 openssl-fips-0.9.8e/ssl/t1_enc.c
|
|
 |
c4366c |
--- openssl-fips-0.9.8e/ssl/t1_enc.c.lucky13 2013-02-25 14:56:11.027380889 +0100
|
|
 |
c4366c |
+++ openssl-fips-0.9.8e/ssl/t1_enc.c 2013-02-25 15:30:15.511540650 +0100
|
|
 |
c4366c |
@@ -523,18 +523,25 @@ err:
|
|
 |
c4366c |
return(0);
|
|
 |
c4366c |
}
|
|
 |
c4366c |
|
|
 |
c4366c |
+/* tls1_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
|
|
 |
c4366c |
+ *
|
|
 |
c4366c |
+ * Returns:
|
|
 |
c4366c |
+ * 0: (in non-constant time) if the record is publically invalid (i.e. too
|
|
 |
c4366c |
+ * short etc).
|
|
 |
c4366c |
+ * 1: if the record's padding is valid / the encryption was successful.
|
|
 |
c4366c |
+ * -1: if the record's padding/AEAD-authenticator is invalid or, if sending,
|
|
 |
c4366c |
+ * an internal error occured.
|
|
 |
c4366c |
+ */
|
|
 |
c4366c |
int tls1_enc(SSL *s, int send)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
SSL3_RECORD *rec;
|
|
 |
c4366c |
EVP_CIPHER_CTX *ds;
|
|
 |
c4366c |
unsigned long l;
|
|
 |
c4366c |
- int bs,i,ii,j,k,n=0;
|
|
 |
c4366c |
+ int bs,i,j,k,pad=0,ret,mac_size=0;
|
|
 |
c4366c |
const EVP_CIPHER *enc;
|
|
 |
c4366c |
|
|
 |
c4366c |
if (send)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
- if (s->write_hash != NULL)
|
|
 |
c4366c |
- n=EVP_MD_size(s->write_hash);
|
|
 |
c4366c |
ds=s->enc_write_ctx;
|
|
 |
c4366c |
rec= &(s->s3->wrec);
|
|
 |
c4366c |
if (s->enc_write_ctx == NULL)
|
|
 |
c4366c |
@@ -544,8 +551,6 @@ int tls1_enc(SSL *s, int send)
|
|
 |
c4366c |
}
|
|
 |
c4366c |
else
|
|
 |
c4366c |
{
|
|
 |
c4366c |
- if (s->read_hash != NULL)
|
|
 |
c4366c |
- n=EVP_MD_size(s->read_hash);
|
|
 |
c4366c |
ds=s->enc_read_ctx;
|
|
 |
c4366c |
rec= &(s->s3->rrec);
|
|
 |
c4366c |
if (s->enc_read_ctx == NULL)
|
|
 |
c4366c |
@@ -558,11 +563,11 @@ int tls1_enc(SSL *s, int send)
|
|
 |
c4366c |
printf("tls1_enc(%d)\n", send);
|
|
 |
c4366c |
#endif /* KSSL_DEBUG */
|
|
 |
c4366c |
|
|
 |
c4366c |
- if ((s->session == NULL) || (ds == NULL) ||
|
|
 |
c4366c |
- (enc == NULL))
|
|
 |
c4366c |
+ if ((s->session == NULL) || (ds == NULL) || (enc == NULL))
|
|
 |
c4366c |
{
|
|
 |
c4366c |
memmove(rec->data,rec->input,rec->length);
|
|
 |
c4366c |
rec->input=rec->data;
|
|
 |
c4366c |
+ ret = 1;
|
|
 |
c4366c |
}
|
|
 |
c4366c |
else
|
|
 |
c4366c |
{
|
|
 |
c4366c |
@@ -609,11 +614,7 @@ int tls1_enc(SSL *s, int send)
|
|
 |
c4366c |
if (!send)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
if (l == 0 || l%bs != 0)
|
|
 |
c4366c |
- {
|
|
 |
c4366c |
- SSLerr(SSL_F_TLS1_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
|
|
 |
c4366c |
- ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED);
|
|
 |
c4366c |
return 0;
|
|
 |
c4366c |
- }
|
|
 |
c4366c |
}
|
|
 |
c4366c |
|
|
 |
c4366c |
EVP_Cipher(ds,rec->data,rec->input,l);
|
|
 |
c4366c |
@@ -627,49 +628,15 @@ int tls1_enc(SSL *s, int send)
|
|
 |
c4366c |
}
|
|
 |
c4366c |
#endif /* KSSL_DEBUG */
|
|
 |
c4366c |
|
|
 |
c4366c |
+ ret = 1;
|
|
 |
c4366c |
+ if (s->read_hash != NULL)
|
|
 |
c4366c |
+ mac_size = EVP_MD_size(s->read_hash);
|
|
 |
c4366c |
if ((bs != 1) && !send)
|
|
 |
c4366c |
- {
|
|
 |
c4366c |
- ii=i=rec->data[l-1]; /* padding_length */
|
|
 |
c4366c |
- i++;
|
|
 |
c4366c |
- /* NB: if compression is in operation the first packet
|
|
 |
c4366c |
- * may not be of even length so the padding bug check
|
|
 |
c4366c |
- * cannot be performed. This bug workaround has been
|
|
 |
c4366c |
- * around since SSLeay so hopefully it is either fixed
|
|
 |
c4366c |
- * now or no buggy implementation supports compression
|
|
 |
c4366c |
- * [steve]
|
|
 |
c4366c |
- */
|
|
 |
c4366c |
- if ( (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG)
|
|
 |
c4366c |
- && !s->expand)
|
|
 |
c4366c |
- {
|
|
 |
c4366c |
- /* First packet is even in size, so check */
|
|
 |
c4366c |
- if ((memcmp(s->s3->read_sequence,
|
|
 |
c4366c |
- "\0\0\0\0\0\0\0\0",8) == 0) && !(ii & 1))
|
|
 |
c4366c |
- s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;
|
|
 |
c4366c |
- if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
|
|
 |
c4366c |
- i--;
|
|
 |
c4366c |
- }
|
|
 |
c4366c |
- /* TLS 1.0 does not bound the number of padding bytes by the block size.
|
|
 |
c4366c |
- * All of them must have value 'padding_length'. */
|
|
 |
c4366c |
- if (i > (int)rec->length)
|
|
 |
c4366c |
- {
|
|
 |
c4366c |
- /* Incorrect padding. SSLerr() and ssl3_alert are done
|
|
 |
c4366c |
- * by caller: we don't want to reveal whether this is
|
|
 |
c4366c |
- * a decryption error or a MAC verification failure
|
|
 |
c4366c |
- * (see http://www.openssl.org/~bodo/tls-cbc.txt) */
|
|
 |
c4366c |
- return -1;
|
|
 |
c4366c |
- }
|
|
 |
c4366c |
- for (j=(int)(l-i); j<(int)l; j++)
|
|
 |
c4366c |
- {
|
|
 |
c4366c |
- if (rec->data[j] != ii)
|
|
 |
c4366c |
- {
|
|
 |
c4366c |
- /* Incorrect padding */
|
|
 |
c4366c |
- return -1;
|
|
 |
c4366c |
- }
|
|
 |
c4366c |
- }
|
|
 |
c4366c |
- rec->length-=i;
|
|
 |
c4366c |
- }
|
|
 |
c4366c |
+ ret = tls1_cbc_remove_padding(s, rec, bs, mac_size);
|
|
 |
c4366c |
+ if (pad && !send)
|
|
 |
c4366c |
+ rec->length -= pad;
|
|
 |
c4366c |
}
|
|
 |
c4366c |
- return(1);
|
|
 |
c4366c |
+ return ret;
|
|
 |
c4366c |
}
|
|
 |
c4366c |
|
|
 |
c4366c |
int tls1_cert_verify_mac(SSL *s, EVP_MD_CTX *in_ctx, unsigned char *out)
|
|
 |
c4366c |
@@ -717,10 +684,10 @@ int tls1_mac(SSL *ssl, unsigned char *md
|
|
 |
c4366c |
SSL3_RECORD *rec;
|
|
 |
c4366c |
unsigned char *mac_sec,*seq;
|
|
 |
c4366c |
const EVP_MD *hash;
|
|
 |
c4366c |
- unsigned int md_size;
|
|
 |
c4366c |
+ size_t md_size, orig_len;
|
|
 |
c4366c |
int i;
|
|
 |
c4366c |
HMAC_CTX hmac;
|
|
 |
c4366c |
- unsigned char buf[5];
|
|
 |
c4366c |
+ unsigned char header[13];
|
|
 |
c4366c |
|
|
 |
c4366c |
if (send)
|
|
 |
c4366c |
{
|
|
 |
c4366c |
@@ -739,20 +706,6 @@ int tls1_mac(SSL *ssl, unsigned char *md
|
|
 |
c4366c |
|
|
 |
c4366c |
md_size=EVP_MD_size(hash);
|
|
 |
c4366c |
|
|
 |
c4366c |
- buf[0]=rec->type;
|
|
 |
c4366c |
- if (ssl->version == DTLS1_VERSION && ssl->client_version == DTLS1_BAD_VER)
|
|
 |
c4366c |
- {
|
|
 |
c4366c |
- buf[1]=TLS1_VERSION_MAJOR;
|
|
 |
c4366c |
- buf[2]=TLS1_VERSION_MINOR;
|
|
 |
c4366c |
- }
|
|
 |
c4366c |
- else {
|
|
 |
c4366c |
- buf[1]=(unsigned char)(ssl->version>>8);
|
|
 |
c4366c |
- buf[2]=(unsigned char)(ssl->version);
|
|
 |
c4366c |
- }
|
|
 |
c4366c |
-
|
|
 |
c4366c |
- buf[3]=rec->length>>8;
|
|
 |
c4366c |
- buf[4]=rec->length&0xff;
|
|
 |
c4366c |
-
|
|
 |
c4366c |
/* I should fix this up TLS TLS TLS TLS TLS XXXXXXXX */
|
|
 |
c4366c |
HMAC_CTX_init(&hmac);
|
|
 |
c4366c |
HMAC_Init_ex(&hmac,mac_sec,EVP_MD_size(hash),hash,NULL);
|
|
 |
c4366c |
@@ -764,16 +717,57 @@ int tls1_mac(SSL *ssl, unsigned char *md
|
|
 |
c4366c |
s2n(send?ssl->d1->w_epoch:ssl->d1->r_epoch, p);
|
|
 |
c4366c |
memcpy (p,&seq[2],6);
|
|
 |
c4366c |
|
|
 |
c4366c |
- HMAC_Update(&hmac,dtlsseq,8);
|
|
 |
c4366c |
+ memcpy(header, dtlsseq, 8);
|
|
 |
c4366c |
}
|
|
 |
c4366c |
else
|
|
 |
c4366c |
- HMAC_Update(&hmac,seq,8);
|
|
 |
c4366c |
+ memcpy(header, seq, 8);
|
|
 |
c4366c |
|
|
 |
c4366c |
- HMAC_Update(&hmac,buf,5);
|
|
 |
c4366c |
- HMAC_Update(&hmac,rec->input,rec->length);
|
|
 |
c4366c |
- HMAC_Final(&hmac,md,&md_size);
|
|
 |
c4366c |
- HMAC_CTX_cleanup(&hmac);
|
|
 |
c4366c |
+ /* kludge: tls1_cbc_remove_padding passes padding length in rec->type */
|
|
 |
c4366c |
+ orig_len = rec->length+md_size+((unsigned int)rec->type>>8);
|
|
 |
c4366c |
+ rec->type &= 0xff;
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ header[8]=rec->type;
|
|
 |
c4366c |
+ header[9]=(unsigned char)(ssl->version>>8);
|
|
 |
c4366c |
+ header[10]=(unsigned char)(ssl->version);
|
|
 |
c4366c |
+ header[11]=(rec->length)>>8;
|
|
 |
c4366c |
+ header[12]=(rec->length)&0xff;
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ if (!send &&
|
|
 |
c4366c |
+ EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
|
|
 |
c4366c |
+ ssl3_cbc_record_digest_supported(hash))
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ /* This is a CBC-encrypted record. We must avoid leaking any
|
|
 |
c4366c |
+ * timing-side channel information about how many blocks of
|
|
 |
c4366c |
+ * data we are hashing because that gives an attacker a
|
|
 |
c4366c |
+ * timing-oracle. */
|
|
 |
c4366c |
+ ssl3_cbc_digest_record(
|
|
 |
c4366c |
+ hash,
|
|
 |
c4366c |
+ md, &md_size,
|
|
 |
c4366c |
+ header, rec->input,
|
|
 |
c4366c |
+ rec->length + md_size, orig_len,
|
|
 |
c4366c |
+ ssl->s3->read_mac_secret,
|
|
 |
c4366c |
+ EVP_MD_size(ssl->read_hash),
|
|
 |
c4366c |
+ 0 /* not SSLv3 */);
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+ else
|
|
 |
c4366c |
+ {
|
|
 |
c4366c |
+ unsigned mds;
|
|
 |
c4366c |
|
|
 |
c4366c |
+ HMAC_Update(&hmac,header,sizeof(header));
|
|
 |
c4366c |
+ HMAC_Update(&hmac,rec->input,rec->length);
|
|
 |
c4366c |
+ HMAC_Final(&hmac,md,&mds;;
|
|
 |
c4366c |
+ md_size = mds;
|
|
 |
c4366c |
+#ifdef OPENSSL_FIPS
|
|
 |
c4366c |
+ if (!send && FIPS_mode())
|
|
 |
c4366c |
+ tls_fips_digest_extra(
|
|
 |
c4366c |
+ ssl->enc_read_ctx,
|
|
 |
c4366c |
+ hash,
|
|
 |
c4366c |
+ &hmac, rec->input,
|
|
 |
c4366c |
+ rec->length, orig_len);
|
|
 |
c4366c |
+#endif
|
|
 |
c4366c |
+ }
|
|
 |
c4366c |
+
|
|
 |
c4366c |
+ HMAC_CTX_cleanup(&hmac);
|
|
 |
c4366c |
#ifdef TLS_DEBUG
|
|
 |
c4366c |
printf("sec=");
|
|
 |
c4366c |
{unsigned int z; for (z=0; z
|
|
 |
c4366c |
diff -up openssl-fips-0.9.8e/test/testssl.lucky13 openssl-fips-0.9.8e/test/testssl
|
|
 |
c4366c |
--- openssl-fips-0.9.8e/test/testssl.lucky13 2005-02-02 00:48:36.000000000 +0100
|
|
 |
c4366c |
+++ openssl-fips-0.9.8e/test/testssl 2013-02-25 14:56:11.422381943 +0100
|
|
 |
c4366c |
@@ -119,6 +119,23 @@ $ssltest -bio_pair -server_auth -client_
|
|
 |
c4366c |
echo test sslv2/sslv3 with both client and server authentication via BIO pair and app verify
|
|
 |
c4366c |
$ssltest -bio_pair -server_auth -client_auth -app_verify $CA $extra || exit 1
|
|
 |
c4366c |
|
|
 |
c4366c |
+echo "Testing ciphersuites"
|
|
 |
c4366c |
+for protocol in SSLv3; do
|
|
 |
c4366c |
+ echo "Testing ciphersuites for $protocol"
|
|
 |
c4366c |
+ for cipher in `../util/shlib_wrap.sh ../apps/openssl ciphers "RSA+$protocol" | tr ':' ' '`; do
|
|
 |
c4366c |
+ echo "Testing $cipher"
|
|
 |
c4366c |
+ prot=""
|
|
 |
c4366c |
+ if [ $protocol == "SSLv3" ] ; then
|
|
 |
c4366c |
+ prot="-ssl3"
|
|
 |
c4366c |
+ fi
|
|
 |
c4366c |
+ $ssltest -cipher $cipher $prot
|
|
 |
c4366c |
+ if [ $? -ne 0 ] ; then
|
|
 |
c4366c |
+ echo "Failed $cipher"
|
|
 |
c4366c |
+ exit 1
|
|
 |
c4366c |
+ fi
|
|
 |
c4366c |
+ done
|
|
 |
c4366c |
+done
|
|
 |
c4366c |
+
|
|
 |
c4366c |
#############################################################################
|
|
 |
c4366c |
|
|
 |
c4366c |
if ../util/shlib_wrap.sh ../apps/openssl no-dh; then
|