David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 1 | /* Copyright (c) 2015, Google Inc. |
| 2 | * |
| 3 | * Permission to use, copy, modify, and/or distribute this software for any |
| 4 | * purpose with or without fee is hereby granted, provided that the above |
| 5 | * copyright notice and this permission notice appear in all copies. |
| 6 | * |
| 7 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES |
| 8 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF |
| 9 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY |
| 10 | * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES |
| 11 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION |
| 12 | * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN |
| 13 | * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ |
| 14 | |
David Benjamin | 86e95b8 | 2017-07-18 16:34:25 -0400 | [diff] [blame] | 15 | #define BORINGSSL_INTERNAL_CXX_TYPES |
| 16 | |
David Benjamin | 9e4e01e | 2015-09-15 01:48:04 -0400 | [diff] [blame] | 17 | #include <openssl/ssl.h> |
| 18 | |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 19 | #include <assert.h> |
| 20 | #include <string.h> |
| 21 | |
| 22 | #include <openssl/aead.h> |
| 23 | #include <openssl/err.h> |
| 24 | #include <openssl/rand.h> |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 25 | |
David Benjamin | 17cf2cb | 2016-12-13 01:07:13 -0500 | [diff] [blame] | 26 | #include "../crypto/internal.h" |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 27 | #include "internal.h" |
| 28 | |
| 29 | |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 30 | #if defined(BORINGSSL_UNSAFE_FUZZER_MODE) |
| 31 | #define FUZZER_MODE true |
| 32 | #else |
| 33 | #define FUZZER_MODE false |
| 34 | #endif |
| 35 | |
David Benjamin | 86e95b8 | 2017-07-18 16:34:25 -0400 | [diff] [blame] | 36 | namespace bssl { |
| 37 | |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 38 | SSLAEADContext::SSLAEADContext(uint16_t version_arg, |
| 39 | const SSL_CIPHER *cipher_arg) |
| 40 | : cipher_(cipher_arg), |
| 41 | version_(version_arg), |
| 42 | variable_nonce_included_in_record_(false), |
| 43 | random_variable_nonce_(false), |
| 44 | omit_length_in_ad_(false), |
| 45 | omit_version_in_ad_(false), |
| 46 | omit_ad_(false), |
| 47 | xor_fixed_nonce_(false) { |
| 48 | OPENSSL_memset(fixed_nonce_, 0, sizeof(fixed_nonce_)); |
| 49 | } |
| 50 | |
| 51 | SSLAEADContext::~SSLAEADContext() {} |
| 52 | |
| 53 | UniquePtr<SSLAEADContext> SSLAEADContext::CreateNullCipher() { |
| 54 | return MakeUnique<SSLAEADContext>(0 /* version */, nullptr /* cipher */); |
| 55 | } |
| 56 | |
| 57 | UniquePtr<SSLAEADContext> SSLAEADContext::Create( |
| 58 | enum evp_aead_direction_t direction, uint16_t version, int is_dtls, |
| 59 | const SSL_CIPHER *cipher, const uint8_t *enc_key, size_t enc_key_len, |
| 60 | const uint8_t *mac_key, size_t mac_key_len, const uint8_t *fixed_iv, |
| 61 | size_t fixed_iv_len) { |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 62 | const EVP_AEAD *aead; |
David Benjamin | 4b0d0e4 | 2016-10-28 17:17:14 -0400 | [diff] [blame] | 63 | size_t expected_mac_key_len, expected_fixed_iv_len; |
| 64 | if (!ssl_cipher_get_evp_aead(&aead, &expected_mac_key_len, |
Steven Valdez | 2f3404b | 2017-05-24 16:54:35 -0400 | [diff] [blame] | 65 | &expected_fixed_iv_len, cipher, version, |
| 66 | is_dtls) || |
David Benjamin | 4b0d0e4 | 2016-10-28 17:17:14 -0400 | [diff] [blame] | 67 | /* Ensure the caller returned correct key sizes. */ |
| 68 | expected_fixed_iv_len != fixed_iv_len || |
| 69 | expected_mac_key_len != mac_key_len) { |
David Benjamin | 3570d73 | 2015-06-29 00:28:17 -0400 | [diff] [blame] | 70 | OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 71 | return nullptr; |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 72 | } |
| 73 | |
| 74 | uint8_t merged_key[EVP_AEAD_MAX_KEY_LENGTH]; |
| 75 | if (mac_key_len > 0) { |
| 76 | /* This is a "stateful" AEAD (for compatibility with pre-AEAD cipher |
| 77 | * suites). */ |
| 78 | if (mac_key_len + enc_key_len + fixed_iv_len > sizeof(merged_key)) { |
David Benjamin | 3570d73 | 2015-06-29 00:28:17 -0400 | [diff] [blame] | 79 | OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 80 | return nullptr; |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 81 | } |
David Benjamin | 17cf2cb | 2016-12-13 01:07:13 -0500 | [diff] [blame] | 82 | OPENSSL_memcpy(merged_key, mac_key, mac_key_len); |
| 83 | OPENSSL_memcpy(merged_key + mac_key_len, enc_key, enc_key_len); |
| 84 | OPENSSL_memcpy(merged_key + mac_key_len + enc_key_len, fixed_iv, |
| 85 | fixed_iv_len); |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 86 | enc_key = merged_key; |
| 87 | enc_key_len += mac_key_len; |
| 88 | enc_key_len += fixed_iv_len; |
| 89 | } |
| 90 | |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 91 | UniquePtr<SSLAEADContext> aead_ctx = |
| 92 | MakeUnique<SSLAEADContext>(version, cipher); |
| 93 | if (!aead_ctx) { |
David Benjamin | 3570d73 | 2015-06-29 00:28:17 -0400 | [diff] [blame] | 94 | OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 95 | return nullptr; |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 96 | } |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 97 | |
| 98 | if (!EVP_AEAD_CTX_init_with_direction( |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 99 | aead_ctx->ctx_.get(), aead, enc_key, enc_key_len, |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 100 | EVP_AEAD_DEFAULT_TAG_LENGTH, direction)) { |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 101 | return nullptr; |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 102 | } |
| 103 | |
| 104 | assert(EVP_AEAD_nonce_length(aead) <= EVP_AEAD_MAX_NONCE_LENGTH); |
David Benjamin | a3d76d0 | 2017-07-14 19:36:07 -0400 | [diff] [blame] | 105 | static_assert(EVP_AEAD_MAX_NONCE_LENGTH < 256, |
| 106 | "variable_nonce_len doesn't fit in uint8_t"); |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 107 | aead_ctx->variable_nonce_len_ = (uint8_t)EVP_AEAD_nonce_length(aead); |
David Benjamin | 51a01a5 | 2015-10-29 13:19:56 -0400 | [diff] [blame] | 108 | if (mac_key_len == 0) { |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 109 | assert(fixed_iv_len <= sizeof(aead_ctx->fixed_nonce_)); |
| 110 | OPENSSL_memcpy(aead_ctx->fixed_nonce_, fixed_iv, fixed_iv_len); |
| 111 | aead_ctx->fixed_nonce_len_ = fixed_iv_len; |
David Benjamin | 13414b3 | 2015-12-09 23:02:39 -0500 | [diff] [blame] | 112 | |
| 113 | if (cipher->algorithm_enc & SSL_CHACHA20POLY1305) { |
| 114 | /* The fixed nonce into the actual nonce (the sequence number). */ |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 115 | aead_ctx->xor_fixed_nonce_ = true; |
| 116 | aead_ctx->variable_nonce_len_ = 8; |
David Benjamin | 13414b3 | 2015-12-09 23:02:39 -0500 | [diff] [blame] | 117 | } else { |
| 118 | /* The fixed IV is prepended to the nonce. */ |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 119 | assert(fixed_iv_len <= aead_ctx->variable_nonce_len_); |
| 120 | aead_ctx->variable_nonce_len_ -= fixed_iv_len; |
David Benjamin | 13414b3 | 2015-12-09 23:02:39 -0500 | [diff] [blame] | 121 | } |
| 122 | |
David Benjamin | b2a985b | 2015-06-21 15:13:57 -0400 | [diff] [blame] | 123 | /* AES-GCM uses an explicit nonce. */ |
| 124 | if (cipher->algorithm_enc & (SSL_AES128GCM | SSL_AES256GCM)) { |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 125 | aead_ctx->variable_nonce_included_in_record_ = true; |
David Benjamin | b2a985b | 2015-06-21 15:13:57 -0400 | [diff] [blame] | 126 | } |
Steven Valdez | 494650c | 2016-05-24 12:43:04 -0400 | [diff] [blame] | 127 | |
| 128 | /* The TLS 1.3 construction XORs the fixed nonce into the sequence number |
| 129 | * and omits the additional data. */ |
| 130 | if (version >= TLS1_3_VERSION) { |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 131 | aead_ctx->xor_fixed_nonce_ = true; |
| 132 | aead_ctx->variable_nonce_len_ = 8; |
| 133 | aead_ctx->variable_nonce_included_in_record_ = false; |
| 134 | aead_ctx->omit_ad_ = true; |
| 135 | assert(fixed_iv_len >= aead_ctx->variable_nonce_len_); |
Steven Valdez | 494650c | 2016-05-24 12:43:04 -0400 | [diff] [blame] | 136 | } |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 137 | } else { |
Steven Valdez | 7975056 | 2016-06-16 06:38:04 -0400 | [diff] [blame] | 138 | assert(version < TLS1_3_VERSION); |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 139 | aead_ctx->variable_nonce_included_in_record_ = true; |
| 140 | aead_ctx->random_variable_nonce_ = true; |
| 141 | aead_ctx->omit_length_in_ad_ = true; |
| 142 | aead_ctx->omit_version_in_ad_ = (version == SSL3_VERSION); |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 143 | } |
| 144 | |
| 145 | return aead_ctx; |
| 146 | } |
| 147 | |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 148 | size_t SSLAEADContext::ExplicitNonceLen() const { |
| 149 | if (!FUZZER_MODE && variable_nonce_included_in_record_) { |
| 150 | return variable_nonce_len_; |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 151 | } |
| 152 | return 0; |
| 153 | } |
| 154 | |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 155 | size_t SSLAEADContext::MaxSuffixLen(size_t extra_in_len) const { |
Martin Kreichgauer | 9f2bffb | 2017-06-30 05:29:50 -0700 | [diff] [blame] | 156 | return extra_in_len + |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 157 | (is_null_cipher() || FUZZER_MODE |
| 158 | ? 0 |
| 159 | : EVP_AEAD_max_overhead(EVP_AEAD_CTX_aead(ctx_.get()))); |
Martin Kreichgauer | 9f2bffb | 2017-06-30 05:29:50 -0700 | [diff] [blame] | 160 | } |
| 161 | |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 162 | size_t SSLAEADContext::MaxOverhead() const { |
| 163 | return ExplicitNonceLen() + MaxSuffixLen(0); |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 164 | } |
| 165 | |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 166 | size_t SSLAEADContext::GetAdditionalData(uint8_t out[13], uint8_t type, |
| 167 | uint16_t wire_version, |
| 168 | const uint8_t seqnum[8], |
| 169 | size_t plaintext_len) { |
| 170 | if (omit_ad_) { |
Steven Valdez | 494650c | 2016-05-24 12:43:04 -0400 | [diff] [blame] | 171 | return 0; |
| 172 | } |
| 173 | |
David Benjamin | 17cf2cb | 2016-12-13 01:07:13 -0500 | [diff] [blame] | 174 | OPENSSL_memcpy(out, seqnum, 8); |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 175 | size_t len = 8; |
| 176 | out[len++] = type; |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 177 | if (!omit_version_in_ad_) { |
| 178 | out[len++] = static_cast<uint8_t>((wire_version >> 8)); |
| 179 | out[len++] = static_cast<uint8_t>(wire_version); |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 180 | } |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 181 | if (!omit_length_in_ad_) { |
| 182 | out[len++] = static_cast<uint8_t>((plaintext_len >> 8)); |
| 183 | out[len++] = static_cast<uint8_t>(plaintext_len); |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 184 | } |
| 185 | return len; |
| 186 | } |
| 187 | |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 188 | bool SSLAEADContext::Open(CBS *out, uint8_t type, uint16_t wire_version, |
| 189 | const uint8_t seqnum[8], uint8_t *in, size_t in_len) { |
| 190 | if (is_null_cipher() || FUZZER_MODE) { |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 191 | /* Handle the initial NULL cipher. */ |
David Benjamin | a7810c1 | 2016-06-06 18:54:51 -0400 | [diff] [blame] | 192 | CBS_init(out, in, in_len); |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 193 | return true; |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 194 | } |
| 195 | |
| 196 | /* TLS 1.2 AEADs include the length in the AD and are assumed to have fixed |
| 197 | * overhead. Otherwise the parameter is unused. */ |
| 198 | size_t plaintext_len = 0; |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 199 | if (!omit_length_in_ad_) { |
| 200 | size_t overhead = MaxOverhead(); |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 201 | if (in_len < overhead) { |
| 202 | /* Publicly invalid. */ |
David Benjamin | 3570d73 | 2015-06-29 00:28:17 -0400 | [diff] [blame] | 203 | OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH); |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 204 | return false; |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 205 | } |
| 206 | plaintext_len = in_len - overhead; |
| 207 | } |
| 208 | uint8_t ad[13]; |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 209 | size_t ad_len = |
| 210 | GetAdditionalData(ad, type, wire_version, seqnum, plaintext_len); |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 211 | |
| 212 | /* Assemble the nonce. */ |
| 213 | uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH]; |
| 214 | size_t nonce_len = 0; |
David Benjamin | 13414b3 | 2015-12-09 23:02:39 -0500 | [diff] [blame] | 215 | |
| 216 | /* Prepend the fixed nonce, or left-pad with zeros if XORing. */ |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 217 | if (xor_fixed_nonce_) { |
| 218 | nonce_len = fixed_nonce_len_ - variable_nonce_len_; |
David Benjamin | 17cf2cb | 2016-12-13 01:07:13 -0500 | [diff] [blame] | 219 | OPENSSL_memset(nonce, 0, nonce_len); |
David Benjamin | 13414b3 | 2015-12-09 23:02:39 -0500 | [diff] [blame] | 220 | } else { |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 221 | OPENSSL_memcpy(nonce, fixed_nonce_, fixed_nonce_len_); |
| 222 | nonce_len += fixed_nonce_len_; |
David Benjamin | 13414b3 | 2015-12-09 23:02:39 -0500 | [diff] [blame] | 223 | } |
| 224 | |
| 225 | /* Add the variable nonce. */ |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 226 | if (variable_nonce_included_in_record_) { |
| 227 | if (in_len < variable_nonce_len_) { |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 228 | /* Publicly invalid. */ |
David Benjamin | 3570d73 | 2015-06-29 00:28:17 -0400 | [diff] [blame] | 229 | OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH); |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 230 | return false; |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 231 | } |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 232 | OPENSSL_memcpy(nonce + nonce_len, in, variable_nonce_len_); |
| 233 | in += variable_nonce_len_; |
| 234 | in_len -= variable_nonce_len_; |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 235 | } else { |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 236 | assert(variable_nonce_len_ == 8); |
| 237 | OPENSSL_memcpy(nonce + nonce_len, seqnum, variable_nonce_len_); |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 238 | } |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 239 | nonce_len += variable_nonce_len_; |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 240 | |
David Benjamin | 13414b3 | 2015-12-09 23:02:39 -0500 | [diff] [blame] | 241 | /* XOR the fixed nonce, if necessary. */ |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 242 | if (xor_fixed_nonce_) { |
| 243 | assert(nonce_len == fixed_nonce_len_); |
| 244 | for (size_t i = 0; i < fixed_nonce_len_; i++) { |
| 245 | nonce[i] ^= fixed_nonce_[i]; |
David Benjamin | 13414b3 | 2015-12-09 23:02:39 -0500 | [diff] [blame] | 246 | } |
| 247 | } |
| 248 | |
David Benjamin | a7810c1 | 2016-06-06 18:54:51 -0400 | [diff] [blame] | 249 | /* Decrypt in-place. */ |
| 250 | size_t len; |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 251 | if (!EVP_AEAD_CTX_open(ctx_.get(), in, &len, in_len, nonce, nonce_len, in, |
| 252 | in_len, ad, ad_len)) { |
| 253 | return false; |
David Benjamin | a7810c1 | 2016-06-06 18:54:51 -0400 | [diff] [blame] | 254 | } |
| 255 | CBS_init(out, in, len); |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 256 | return true; |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 257 | } |
| 258 | |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 259 | bool SSLAEADContext::SealScatter(uint8_t *out_prefix, uint8_t *out, |
| 260 | uint8_t *out_suffix, size_t *out_suffix_len, |
| 261 | size_t max_out_suffix_len, uint8_t type, |
| 262 | uint16_t wire_version, const uint8_t seqnum[8], |
| 263 | const uint8_t *in, size_t in_len, |
| 264 | const uint8_t *extra_in, size_t extra_in_len) { |
Martin Kreichgauer | 9f2bffb | 2017-06-30 05:29:50 -0700 | [diff] [blame] | 265 | if ((in != out && buffers_alias(in, in_len, out, in_len)) || |
| 266 | buffers_alias(in, in_len, out_suffix, max_out_suffix_len)) { |
| 267 | OPENSSL_PUT_ERROR(SSL, SSL_R_OUTPUT_ALIASES_INPUT); |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 268 | return false; |
Martin Kreichgauer | 9f2bffb | 2017-06-30 05:29:50 -0700 | [diff] [blame] | 269 | } |
| 270 | if (extra_in_len > max_out_suffix_len) { |
| 271 | OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL); |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 272 | return false; |
Martin Kreichgauer | 9f2bffb | 2017-06-30 05:29:50 -0700 | [diff] [blame] | 273 | } |
| 274 | |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 275 | if (is_null_cipher() || FUZZER_MODE) { |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 276 | /* Handle the initial NULL cipher. */ |
David Benjamin | 17cf2cb | 2016-12-13 01:07:13 -0500 | [diff] [blame] | 277 | OPENSSL_memmove(out, in, in_len); |
Martin Kreichgauer | 9f2bffb | 2017-06-30 05:29:50 -0700 | [diff] [blame] | 278 | OPENSSL_memmove(out_suffix, extra_in, extra_in_len); |
| 279 | *out_suffix_len = extra_in_len; |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 280 | return true; |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 281 | } |
| 282 | |
| 283 | uint8_t ad[13]; |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 284 | size_t ad_len = GetAdditionalData(ad, type, wire_version, seqnum, in_len); |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 285 | |
| 286 | /* Assemble the nonce. */ |
| 287 | uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH]; |
| 288 | size_t nonce_len = 0; |
David Benjamin | 13414b3 | 2015-12-09 23:02:39 -0500 | [diff] [blame] | 289 | |
| 290 | /* Prepend the fixed nonce, or left-pad with zeros if XORing. */ |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 291 | if (xor_fixed_nonce_) { |
| 292 | nonce_len = fixed_nonce_len_ - variable_nonce_len_; |
David Benjamin | 17cf2cb | 2016-12-13 01:07:13 -0500 | [diff] [blame] | 293 | OPENSSL_memset(nonce, 0, nonce_len); |
David Benjamin | 13414b3 | 2015-12-09 23:02:39 -0500 | [diff] [blame] | 294 | } else { |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 295 | OPENSSL_memcpy(nonce, fixed_nonce_, fixed_nonce_len_); |
| 296 | nonce_len += fixed_nonce_len_; |
David Benjamin | 13414b3 | 2015-12-09 23:02:39 -0500 | [diff] [blame] | 297 | } |
| 298 | |
| 299 | /* Select the variable nonce. */ |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 300 | if (random_variable_nonce_) { |
| 301 | assert(variable_nonce_included_in_record_); |
| 302 | if (!RAND_bytes(nonce + nonce_len, variable_nonce_len_)) { |
| 303 | return false; |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 304 | } |
| 305 | } else { |
| 306 | /* When sending we use the sequence number as the variable part of the |
| 307 | * nonce. */ |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 308 | assert(variable_nonce_len_ == 8); |
| 309 | OPENSSL_memcpy(nonce + nonce_len, seqnum, variable_nonce_len_); |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 310 | } |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 311 | nonce_len += variable_nonce_len_; |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 312 | |
| 313 | /* Emit the variable nonce if included in the record. */ |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 314 | if (variable_nonce_included_in_record_) { |
| 315 | assert(!xor_fixed_nonce_); |
| 316 | if (buffers_alias(in, in_len, out_prefix, variable_nonce_len_)) { |
David Benjamin | 3570d73 | 2015-06-29 00:28:17 -0400 | [diff] [blame] | 317 | OPENSSL_PUT_ERROR(SSL, SSL_R_OUTPUT_ALIASES_INPUT); |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 318 | return false; |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 319 | } |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 320 | OPENSSL_memcpy(out_prefix, nonce + fixed_nonce_len_, |
| 321 | variable_nonce_len_); |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 322 | } |
| 323 | |
David Benjamin | 13414b3 | 2015-12-09 23:02:39 -0500 | [diff] [blame] | 324 | /* XOR the fixed nonce, if necessary. */ |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 325 | if (xor_fixed_nonce_) { |
| 326 | assert(nonce_len == fixed_nonce_len_); |
| 327 | for (size_t i = 0; i < fixed_nonce_len_; i++) { |
| 328 | nonce[i] ^= fixed_nonce_[i]; |
David Benjamin | 13414b3 | 2015-12-09 23:02:39 -0500 | [diff] [blame] | 329 | } |
| 330 | } |
| 331 | |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 332 | return !!EVP_AEAD_CTX_seal_scatter( |
| 333 | ctx_.get(), out, out_suffix, out_suffix_len, max_out_suffix_len, nonce, |
| 334 | nonce_len, in, in_len, extra_in, extra_in_len, ad, ad_len); |
Martin Kreichgauer | 9f2bffb | 2017-06-30 05:29:50 -0700 | [diff] [blame] | 335 | } |
| 336 | |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 337 | bool SSLAEADContext::Seal(uint8_t *out, size_t *out_len, size_t max_out_len, |
| 338 | uint8_t type, uint16_t wire_version, |
| 339 | const uint8_t seqnum[8], const uint8_t *in, |
| 340 | size_t in_len) { |
| 341 | size_t prefix_len = ExplicitNonceLen(); |
Martin Kreichgauer | 9f2bffb | 2017-06-30 05:29:50 -0700 | [diff] [blame] | 342 | if (in_len + prefix_len < in_len) { |
| 343 | OPENSSL_PUT_ERROR(CIPHER, SSL_R_RECORD_TOO_LARGE); |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 344 | return false; |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 345 | } |
Martin Kreichgauer | 9f2bffb | 2017-06-30 05:29:50 -0700 | [diff] [blame] | 346 | if (in_len + prefix_len > max_out_len) { |
| 347 | OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL); |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 348 | return false; |
Martin Kreichgauer | 9f2bffb | 2017-06-30 05:29:50 -0700 | [diff] [blame] | 349 | } |
| 350 | |
| 351 | size_t suffix_len; |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 352 | if (!SealScatter(out, out + prefix_len, out + prefix_len + in_len, |
| 353 | &suffix_len, max_out_len - prefix_len - in_len, type, |
| 354 | wire_version, seqnum, in, in_len, 0, 0)) { |
| 355 | return false; |
Martin Kreichgauer | 9f2bffb | 2017-06-30 05:29:50 -0700 | [diff] [blame] | 356 | } |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 357 | assert(suffix_len <= MaxSuffixLen(0)); |
Martin Kreichgauer | 9f2bffb | 2017-06-30 05:29:50 -0700 | [diff] [blame] | 358 | *out_len = prefix_len + in_len + suffix_len; |
David Benjamin | cfc11c2 | 2017-07-18 22:45:18 -0400 | [diff] [blame^] | 359 | return true; |
| 360 | } |
| 361 | |
| 362 | bool SSLAEADContext::GetIV(const uint8_t **out_iv, size_t *out_iv_len) const { |
| 363 | return !is_null_cipher() && |
| 364 | EVP_AEAD_CTX_get_iv(ctx_.get(), out_iv, out_iv_len); |
David Benjamin | 31a0779 | 2015-03-03 14:20:26 -0500 | [diff] [blame] | 365 | } |
David Benjamin | 86e95b8 | 2017-07-18 16:34:25 -0400 | [diff] [blame] | 366 | |
| 367 | } // namespace bssl |