/[smeserver]/rpms/openssl/sme8/openssl-fips-0.9.8e-cve-2013-0169.patch
ViewVC logotype

Annotation of /rpms/openssl/sme8/openssl-fips-0.9.8e-cve-2013-0169.patch

Parent Directory Parent Directory | Revision Log Revision Log | View Revision Graph Revision Graph

Revision 1.1 - (hide annotations) (download)
Tue Feb 18 03:03:09 2014 UTC (10 years, 3 months ago) by wellsi
Branch: MAIN
CVS Tags: openssl-0_9_8e-28_el5_sme, openssl-0_9_8e-33_1_el5_sme, openssl-0_9_8e-32_1_el5_sme, openssl-0_9_8e-27_1_el5_sme, openssl-0_9_8e-27_el5_10_1, openssl-0_9_8e-31_1_el5_sme, HEAD
Branch point for: upstream 
Initial import
1 wellsi 1.1 diff -up openssl-fips-0.9.8e/crypto/cryptlib.c.lucky13 openssl-fips-0.9.8e/crypto/cryptlib.c
2     --- openssl-fips-0.9.8e/crypto/cryptlib.c.lucky13 2007-07-26 18:46:54.000000000 +0200
3     +++ openssl-fips-0.9.8e/crypto/cryptlib.c 2013-02-25 14:56:11.392381859 +0100
4     @@ -543,3 +543,16 @@ void OpenSSLDie(const char *file,int lin
5     }
6    
7     void *OPENSSL_stderr(void) { return stderr; }
8     +
9     +int CRYPTO_memcmp(const void *in_a, const void *in_b, size_t len)
10     + {
11     + size_t i;
12     + const unsigned char *a = in_a;
13     + const unsigned char *b = in_b;
14     + unsigned char x = 0;
15     +
16     + for (i = 0; i < len; i++)
17     + x |= a[i] ^ b[i];
18     +
19     + return x;
20     + }
21     diff -up openssl-fips-0.9.8e/crypto/crypto.h.lucky13 openssl-fips-0.9.8e/crypto/crypto.h
22     --- openssl-fips-0.9.8e/crypto/crypto.h.lucky13 2013-02-25 14:56:11.049380949 +0100
23     +++ openssl-fips-0.9.8e/crypto/crypto.h 2013-02-25 14:56:11.393381862 +0100
24     @@ -592,6 +592,13 @@ unsigned long *OPENSSL_ia32cap_loc(void)
25    
26     #endif /* def OPENSSL_FIPS */
27    
28     +/* CRYPTO_memcmp returns zero iff the |len| bytes at |a| and |b| are equal. It
29     + * takes an amount of time dependent on |len|, but independent of the contents
30     + * of |a| and |b|. Unlike memcmp, it cannot be used to put elements into a
31     + * defined order as the return value when a != b is undefined, other than to be
32     + * non-zero. */
33     +int CRYPTO_memcmp(const void *a, const void *b, size_t len);
34     +
35     /* BEGIN ERROR CODES */
36     /* The following lines are auto generated by the script mkerr.pl. Any changes
37     * made after this point may be overwritten when the script is next run.
38     diff -up openssl-fips-0.9.8e/crypto/rsa/rsa_oaep.c.lucky13 openssl-fips-0.9.8e/crypto/rsa/rsa_oaep.c
39     --- openssl-fips-0.9.8e/crypto/rsa/rsa_oaep.c.lucky13 2007-03-22 01:38:34.000000000 +0100
40     +++ openssl-fips-0.9.8e/crypto/rsa/rsa_oaep.c 2013-02-25 14:56:11.394381865 +0100
41     @@ -136,7 +136,7 @@ int RSA_padding_check_PKCS1_OAEP(unsigne
42    
43     EVP_Digest((void *)param, plen, phash, NULL, EVP_sha1(), NULL);
44    
45     - if (memcmp(db, phash, SHA_DIGEST_LENGTH) != 0 || bad)
46     + if (CRYPTO_memcmp(db, phash, SHA_DIGEST_LENGTH) != 0 || bad)
47     goto decoding_err;
48     else
49     {
50     diff -up openssl-fips-0.9.8e/ssl/d1_enc.c.lucky13 openssl-fips-0.9.8e/ssl/d1_enc.c
51     --- openssl-fips-0.9.8e/ssl/d1_enc.c.lucky13 2013-02-25 14:56:11.374381809 +0100
52     +++ openssl-fips-0.9.8e/ssl/d1_enc.c 2013-02-25 14:56:11.395381868 +0100
53     @@ -122,18 +122,30 @@
54     #include <openssl/rand.h>
55    
56    
57     +/* dtls1_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
58     + *
59     + * Returns:
60     + * 0: (in non-constant time) if the record is publically invalid (i.e. too
61     + * short etc).
62     + * 1: if the record's padding is valid / the encryption was successful.
63     + * -1: if the record's padding/AEAD-authenticator is invalid or, if sending,
64     + * an internal error occured. */
65     int dtls1_enc(SSL *s, int send)
66     {
67     SSL3_RECORD *rec;
68     EVP_CIPHER_CTX *ds;
69     unsigned long l;
70     - int bs,i,ii,j,k,n=0;
71     + int bs,i,j,k,mac_size=0;
72     const EVP_CIPHER *enc;
73    
74     if (send)
75     {
76     - if (s->write_hash != NULL)
77     - n=EVP_MD_size(s->write_hash);
78     + if (s->write_hash)
79     + {
80     + mac_size=EVP_MD_size(s->write_hash);
81     + if (mac_size < 0)
82     + return -1;
83     + }
84     ds=s->enc_write_ctx;
85     rec= &(s->s3->wrec);
86     if (s->enc_write_ctx == NULL)
87     @@ -147,15 +159,18 @@ int dtls1_enc(SSL *s, int send)
88     __FILE__, __LINE__);
89     else if ( EVP_CIPHER_block_size(ds->cipher) > 1)
90     {
91     - if (!RAND_bytes(rec->input, EVP_CIPHER_block_size(ds->cipher)))
92     + if (RAND_bytes(rec->input, EVP_CIPHER_block_size(ds->cipher)) <= 0)
93     return -1;
94     }
95     }
96     }
97     else
98     {
99     - if (s->read_hash != NULL)
100     - n=EVP_MD_size(s->read_hash);
101     + if (s->read_hash)
102     + {
103     + mac_size=EVP_MD_size(s->read_hash);
104     + OPENSSL_assert(mac_size >= 0);
105     + }
106     ds=s->enc_read_ctx;
107     rec= &(s->s3->rrec);
108     if (s->enc_read_ctx == NULL)
109     @@ -219,11 +234,7 @@ int dtls1_enc(SSL *s, int send)
110     if (!send)
111     {
112     if (l == 0 || l%bs != 0)
113     - {
114     - SSLerr(SSL_F_DTLS1_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
115     - ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED);
116     return 0;
117     - }
118     }
119    
120     EVP_Cipher(ds,rec->data,rec->input,l);
121     @@ -238,43 +249,7 @@ int dtls1_enc(SSL *s, int send)
122     #endif /* KSSL_DEBUG */
123    
124     if ((bs != 1) && !send)
125     - {
126     - ii=i=rec->data[l-1]; /* padding_length */
127     - i++;
128     - if (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG)
129     - {
130     - /* First packet is even in size, so check */
131     - if ((memcmp(s->s3->read_sequence,
132     - "\0\0\0\0\0\0\0\0",8) == 0) && !(ii & 1))
133     - s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;
134     - if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
135     - i--;
136     - }
137     - /* TLS 1.0 does not bound the number of padding bytes by the block size.
138     - * All of them must have value 'padding_length'. */
139     - if (i + bs > (int)rec->length)
140     - {
141     - /* Incorrect padding. SSLerr() and ssl3_alert are done
142     - * by caller: we don't want to reveal whether this is
143     - * a decryption error or a MAC verification failure
144     - * (see http://www.openssl.org/~bodo/tls-cbc.txt)
145     - */
146     - return -1;
147     - }
148     - for (j=(int)(l-i); j<(int)l; j++)
149     - {
150     - if (rec->data[j] != ii)
151     - {
152     - /* Incorrect padding */
153     - return -1;
154     - }
155     - }
156     - rec->length-=i;
157     -
158     - rec->data += bs; /* skip the implicit IV */
159     - rec->input += bs;
160     - rec->length -= bs;
161     - }
162     + return tls1_cbc_remove_padding(s, rec, bs, mac_size);
163     }
164     return(1);
165     }
166     diff -up openssl-fips-0.9.8e/ssl/d1_pkt.c.lucky13 openssl-fips-0.9.8e/ssl/d1_pkt.c
167     --- openssl-fips-0.9.8e/ssl/d1_pkt.c.lucky13 2013-02-25 14:56:11.278381571 +0100
168     +++ openssl-fips-0.9.8e/ssl/d1_pkt.c 2013-02-25 14:56:11.400381882 +0100
169     @@ -328,16 +328,12 @@ dtls1_get_buffered_record(SSL *s)
170     static int
171     dtls1_process_record(SSL *s)
172     {
173     - int al;
174     - int clear=0;
175     - int enc_err;
176     + int i,al;
177     + int enc_err;
178     SSL_SESSION *sess;
179     - SSL3_RECORD *rr;
180     - unsigned int mac_size;
181     + SSL3_RECORD *rr;
182     + unsigned int mac_size, orig_len;
183     unsigned char md[EVP_MAX_MD_SIZE];
184     - int decryption_failed_or_bad_record_mac = 0;
185     - unsigned char *mac = NULL;
186     -
187    
188     rr= &(s->s3->rrec);
189     sess = s->session;
190     @@ -369,12 +365,16 @@ dtls1_process_record(SSL *s)
191     rr->data=rr->input;
192    
193     enc_err = s->method->ssl3_enc->enc(s,0);
194     - if (enc_err <= 0)
195     + /* enc_err is:
196     + * 0: (in non-constant time) if the record is publically invalid.
197     + * 1: if the padding is valid
198     + * -1: if the padding is invalid */
199     + if (enc_err == 0)
200     {
201     - /* To minimize information leaked via timing, we will always
202     - * perform all computations before discarding the message.
203     - */
204     - decryption_failed_or_bad_record_mac = 1;
205     + /* For DTLS we simply ignore bad packets. */
206     + rr->length = 0;
207     + s->packet_length = 0;
208     + goto err;
209     }
210    
211     #ifdef TLS_DEBUG
212     @@ -384,41 +384,62 @@ printf("\n");
213     #endif
214    
215     /* r->length is now the compressed data plus mac */
216     -if ( (sess == NULL) ||
217     - (s->enc_read_ctx == NULL) ||
218     - (s->read_hash == NULL))
219     - clear=1;
220     -
221     - if (!clear)
222     + if ((sess != NULL) &&
223     + (s->enc_read_ctx != NULL) &&
224     + (s->read_hash != NULL))
225     {
226     + /* s->read_hash != NULL => mac_size != -1 */
227     + unsigned char *mac = NULL;
228     + unsigned char mac_tmp[EVP_MAX_MD_SIZE];
229     mac_size=EVP_MD_size(s->read_hash);
230     + OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);
231    
232     - if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+mac_size)
233     + /* kludge: *_cbc_remove_padding passes padding length in rr->type */
234     + orig_len = rr->length+((unsigned int)rr->type>>8);
235     +
236     + /* orig_len is the length of the record before any padding was
237     + * removed. This is public information, as is the MAC in use,
238     + * therefore we can safely process the record in a different
239     + * amount of time if it's too short to possibly contain a MAC.
240     + */
241     + if (orig_len < mac_size ||
242     + /* CBC records must have a padding length byte too. */
243     + (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
244     + orig_len < mac_size+1))
245     {
246     -#if 0 /* OK only for stream ciphers (then rr->length is visible from ciphertext anyway) */
247     - al=SSL_AD_RECORD_OVERFLOW;
248     - SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);
249     + al=SSL_AD_DECODE_ERROR;
250     + SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_LENGTH_TOO_SHORT);
251     goto f_err;
252     -#else
253     - decryption_failed_or_bad_record_mac = 1;
254     -#endif
255     }
256     - /* check the MAC for rr->input (it's in mac_size bytes at the tail) */
257     - if (rr->length >= mac_size)
258     +
259     + if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE)
260     {
261     + /* We update the length so that the TLS header bytes
262     + * can be constructed correctly but we need to extract
263     + * the MAC in constant time from within the record,
264     + * without leaking the contents of the padding bytes.
265     + * */
266     + mac = mac_tmp;
267     + ssl3_cbc_copy_mac(mac_tmp, rr, mac_size, orig_len);
268     rr->length -= mac_size;
269     - mac = &rr->data[rr->length];
270     }
271     else
272     - rr->length = 0;
273     - s->method->ssl3_enc->mac(s,md,0);
274     - if (mac == NULL || memcmp(md, mac, mac_size) != 0)
275     {
276     - decryption_failed_or_bad_record_mac = 1;
277     + /* In this case there's no padding, so |orig_len|
278     + * equals |rec->length| and we checked that there's
279     + * enough bytes for |mac_size| above. */
280     + rr->length -= mac_size;
281     + mac = &rr->data[rr->length];
282     }
283     +
284     + i=s->method->ssl3_enc->mac(s,md,0 /* not send */);
285     + if (i < 0 || mac == NULL || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0)
286     + enc_err = -1;
287     + if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+mac_size)
288     + enc_err = -1;
289     }
290    
291     - if (decryption_failed_or_bad_record_mac)
292     + if (enc_err < 0)
293     {
294     /* decryption failed, silently discard message */
295     rr->length = 0;
296     diff -up openssl-fips-0.9.8e/ssl/Makefile.lucky13 openssl-fips-0.9.8e/ssl/Makefile
297     --- openssl-fips-0.9.8e/ssl/Makefile.lucky13 2013-02-25 14:56:11.212381386 +0100
298     +++ openssl-fips-0.9.8e/ssl/Makefile 2013-02-25 14:56:11.404381893 +0100
299     @@ -22,7 +22,7 @@ LIB=$(TOP)/libssl.a
300     SHARED_LIB= libssl$(SHLIB_EXT)
301     LIBSRC= \
302     s2_meth.c s2_srvr.c s2_clnt.c s2_lib.c s2_enc.c s2_pkt.c \
303     - s3_meth.c s3_srvr.c s3_clnt.c s3_lib.c s3_enc.c s3_pkt.c s3_both.c \
304     + s3_meth.c s3_srvr.c s3_clnt.c s3_lib.c s3_enc.c s3_pkt.c s3_both.c s3_cbc.c \
305     s23_meth.c s23_srvr.c s23_clnt.c s23_lib.c s23_pkt.c \
306     t1_meth.c t1_srvr.c t1_clnt.c t1_lib.c t1_enc.c \
307     d1_meth.c d1_srvr.c d1_clnt.c d1_lib.c d1_pkt.c \
308     @@ -33,7 +33,7 @@ LIBSRC= \
309     bio_ssl.c ssl_err.c kssl.c t1_reneg.c
310     LIBOBJ= \
311     s2_meth.o s2_srvr.o s2_clnt.o s2_lib.o s2_enc.o s2_pkt.o \
312     - s3_meth.o s3_srvr.o s3_clnt.o s3_lib.o s3_enc.o s3_pkt.o s3_both.o \
313     + s3_meth.o s3_srvr.o s3_clnt.o s3_lib.o s3_enc.o s3_pkt.o s3_both.o s3_cbc.o \
314     s23_meth.o s23_srvr.o s23_clnt.o s23_lib.o s23_pkt.o \
315     t1_meth.o t1_srvr.o t1_clnt.o t1_lib.o t1_enc.o \
316     d1_meth.o d1_srvr.o d1_clnt.o d1_lib.o d1_pkt.o \
317     diff -up openssl-fips-0.9.8e/ssl/s2_clnt.c.lucky13 openssl-fips-0.9.8e/ssl/s2_clnt.c
318     --- openssl-fips-0.9.8e/ssl/s2_clnt.c.lucky13 2013-02-25 14:56:11.097381084 +0100
319     +++ openssl-fips-0.9.8e/ssl/s2_clnt.c 2013-02-25 14:56:11.404381893 +0100
320     @@ -935,7 +935,7 @@ static int get_server_verify(SSL *s)
321     s->msg_callback(0, s->version, 0, p, len, s, s->msg_callback_arg); /* SERVER-VERIFY */
322     p += 1;
323    
324     - if (memcmp(p,s->s2->challenge,s->s2->challenge_length) != 0)
325     + if (CRYPTO_memcmp(p,s->s2->challenge,s->s2->challenge_length) != 0)
326     {
327     ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
328     SSLerr(SSL_F_GET_SERVER_VERIFY,SSL_R_CHALLENGE_IS_DIFFERENT);
329     diff -up openssl-fips-0.9.8e/ssl/s2_pkt.c.lucky13 openssl-fips-0.9.8e/ssl/s2_pkt.c
330     --- openssl-fips-0.9.8e/ssl/s2_pkt.c.lucky13 2003-12-27 17:10:30.000000000 +0100
331     +++ openssl-fips-0.9.8e/ssl/s2_pkt.c 2013-02-25 14:56:11.405381896 +0100
332     @@ -267,8 +267,7 @@ static int ssl2_read_internal(SSL *s, vo
333     s->s2->ract_data_length-=mac_size;
334     ssl2_mac(s,mac,0);
335     s->s2->ract_data_length-=s->s2->padding;
336     - if ( (memcmp(mac,s->s2->mac_data,
337     - (unsigned int)mac_size) != 0) ||
338     + if ( (CRYPTO_memcmp(mac,s->s2->mac_data,mac_size) != 0) ||
339     (s->s2->rlength%EVP_CIPHER_CTX_block_size(s->enc_read_ctx) != 0))
340     {
341     SSLerr(SSL_F_SSL2_READ_INTERNAL,SSL_R_BAD_MAC_DECODE);
342     diff -up openssl-fips-0.9.8e/ssl/s3_both.c.lucky13 openssl-fips-0.9.8e/ssl/s3_both.c
343     --- openssl-fips-0.9.8e/ssl/s3_both.c.lucky13 2013-02-25 14:56:11.221381411 +0100
344     +++ openssl-fips-0.9.8e/ssl/s3_both.c 2013-02-25 14:56:11.406381899 +0100
345     @@ -242,7 +242,7 @@ int ssl3_get_finished(SSL *s, int a, int
346     goto f_err;
347     }
348    
349     - if (memcmp(p, s->s3->tmp.peer_finish_md, i) != 0)
350     + if (CRYPTO_memcmp(p, s->s3->tmp.peer_finish_md, i) != 0)
351     {
352     al=SSL_AD_DECRYPT_ERROR;
353     SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_DIGEST_CHECK_FAILED);
354     diff -up openssl-fips-0.9.8e/ssl/s3_cbc.c.lucky13 openssl-fips-0.9.8e/ssl/s3_cbc.c
355     --- openssl-fips-0.9.8e/ssl/s3_cbc.c.lucky13 2013-02-25 14:56:11.407381902 +0100
356     +++ openssl-fips-0.9.8e/ssl/s3_cbc.c 2013-02-25 14:56:11.407381902 +0100
357     @@ -0,0 +1,783 @@
358     +/* ssl/s3_cbc.c */
359     +/* ====================================================================
360     + * Copyright (c) 2012 The OpenSSL Project. All rights reserved.
361     + *
362     + * Redistribution and use in source and binary forms, with or without
363     + * modification, are permitted provided that the following conditions
364     + * are met:
365     + *
366     + * 1. Redistributions of source code must retain the above copyright
367     + * notice, this list of conditions and the following disclaimer.
368     + *
369     + * 2. Redistributions in binary form must reproduce the above copyright
370     + * notice, this list of conditions and the following disclaimer in
371     + * the documentation and/or other materials provided with the
372     + * distribution.
373     + *
374     + * 3. All advertising materials mentioning features or use of this
375     + * software must display the following acknowledgment:
376     + * "This product includes software developed by the OpenSSL Project
377     + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
378     + *
379     + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
380     + * endorse or promote products derived from this software without
381     + * prior written permission. For written permission, please contact
382     + * openssl-core@openssl.org.
383     + *
384     + * 5. Products derived from this software may not be called "OpenSSL"
385     + * nor may "OpenSSL" appear in their names without prior written
386     + * permission of the OpenSSL Project.
387     + *
388     + * 6. Redistributions of any form whatsoever must retain the following
389     + * acknowledgment:
390     + * "This product includes software developed by the OpenSSL Project
391     + * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
392     + *
393     + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
394     + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
395     + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
396     + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
397     + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
398     + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
399     + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
400     + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
401     + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
402     + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
403     + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
404     + * OF THE POSSIBILITY OF SUCH DAMAGE.
405     + * ====================================================================
406     + *
407     + * This product includes cryptographic software written by Eric Young
408     + * (eay@cryptsoft.com). This product includes software written by Tim
409     + * Hudson (tjh@cryptsoft.com).
410     + *
411     + */
412     +
413     +#include "ssl_locl.h"
414     +
415     +#include <openssl/md5.h>
416     +#include <openssl/sha.h>
417     +
418     +/* MAX_HASH_BIT_COUNT_BYTES is the maximum number of bytes in the hash's length
419     + * field. (SHA-384/512 have 128-bit length.) */
420     +#define MAX_HASH_BIT_COUNT_BYTES 16
421     +
422     +/* MAX_HASH_BLOCK_SIZE is the maximum hash block size that we'll support.
423     + * Currently SHA-384/512 has a 128-byte block size and that's the largest
424     + * supported by TLS.) */
425     +#define MAX_HASH_BLOCK_SIZE 128
426     +
427     +/* Some utility functions are needed:
428     + *
429     + * These macros return the given value with the MSB copied to all the other
430     + * bits. They use the fact that arithmetic shift shifts-in the sign bit.
431     + * However, this is not ensured by the C standard so you may need to replace
432     + * them with something else on odd CPUs. */
433     +#define DUPLICATE_MSB_TO_ALL(x) ( (unsigned)( (int)(x) >> (sizeof(int)*8-1) ) )
434     +#define DUPLICATE_MSB_TO_ALL_8(x) ((unsigned char)(DUPLICATE_MSB_TO_ALL(x)))
435     +
436     +/* constant_time_lt returns 0xff if a<b and 0x00 otherwise. */
437     +static unsigned constant_time_lt(unsigned a, unsigned b)
438     + {
439     + a -= b;
440     + return DUPLICATE_MSB_TO_ALL(a);
441     + }
442     +
443     +/* constant_time_ge returns 0xff if a>=b and 0x00 otherwise. */
444     +static unsigned constant_time_ge(unsigned a, unsigned b)
445     + {
446     + a -= b;
447     + return DUPLICATE_MSB_TO_ALL(~a);
448     + }
449     +
450     +/* constant_time_eq_8 returns 0xff if a==b and 0x00 otherwise. */
451     +static unsigned char constant_time_eq_8(unsigned a, unsigned b)
452     + {
453     + unsigned c = a ^ b;
454     + c--;
455     + return DUPLICATE_MSB_TO_ALL_8(c);
456     + }
457     +
458     +/* ssl3_cbc_remove_padding removes padding from the decrypted, SSLv3, CBC
459     + * record in |rec| by updating |rec->length| in constant time.
460     + *
461     + * block_size: the block size of the cipher used to encrypt the record.
462     + * returns:
463     + * 0: (in non-constant time) if the record is publicly invalid.
464     + * 1: if the padding was valid
465     + * -1: otherwise. */
466     +int ssl3_cbc_remove_padding(const SSL* s,
467     + SSL3_RECORD *rec,
468     + unsigned block_size,
469     + unsigned mac_size)
470     + {
471     + unsigned padding_length, good;
472     + const unsigned overhead = 1 /* padding length byte */ + mac_size;
473     +
474     + /* These lengths are all public so we can test them in non-constant
475     + * time. */
476     + if (overhead > rec->length)
477     + return 0;
478     +
479     + padding_length = rec->data[rec->length-1];
480     + good = constant_time_ge(rec->length, padding_length+overhead);
481     + /* SSLv3 requires that the padding is minimal. */
482     + good &= constant_time_ge(block_size, padding_length+1);
483     + padding_length = good & (padding_length+1);
484     + rec->length -= padding_length;
485     + rec->type |= padding_length<<8; /* kludge: pass padding length */
486     + return (int)((good & 1) | (~good & -1));
487     +}
488     +
489     +/* tls1_cbc_remove_padding removes the CBC padding from the decrypted, TLS, CBC
490     + * record in |rec| in constant time and returns 1 if the padding is valid and
491     + * -1 otherwise. It also removes any explicit IV from the start of the record
492     + * without leaking any timing about whether there was enough space after the
493     + * padding was removed.
494     + *
495     + * block_size: the block size of the cipher used to encrypt the record.
496     + * returns:
497     + * 0: (in non-constant time) if the record is publicly invalid.
498     + * 1: if the padding was valid
499     + * -1: otherwise. */
500     +int tls1_cbc_remove_padding(const SSL* s,
501     + SSL3_RECORD *rec,
502     + unsigned block_size,
503     + unsigned mac_size)
504     + {
505     + unsigned padding_length, good, to_check, i;
506     + const unsigned overhead = 1 /* padding length byte */ + mac_size;
507     + /* Check if version requires explicit IV */
508     + if (s->version == DTLS1_VERSION || s->version == DTLS1_BAD_VER)
509     + {
510     + /* These lengths are all public so we can test them in
511     + * non-constant time.
512     + */
513     + if (overhead + block_size > rec->length)
514     + return 0;
515     + /* We can now safely skip explicit IV */
516     + rec->data += block_size;
517     + rec->input += block_size;
518     + rec->length -= block_size;
519     + }
520     + else if (overhead > rec->length)
521     + return 0;
522     +
523     + padding_length = rec->data[rec->length-1];
524     +
525     + /* NB: if compression is in operation the first packet may not be of
526     + * even length so the padding bug check cannot be performed. This bug
527     + * workaround has been around since SSLeay so hopefully it is either
528     + * fixed now or no buggy implementation supports compression [steve]
529     + */
530     + if ( (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand)
531     + {
532     + /* First packet is even in size, so check */
533     + if ((memcmp(s->s3->read_sequence, "\0\0\0\0\0\0\0\0",8) == 0) &&
534     + !(padding_length & 1))
535     + {
536     + s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;
537     + }
538     + if ((s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG) &&
539     + padding_length > 0)
540     + {
541     + padding_length--;
542     + }
543     + }
544     +
545     + good = constant_time_ge(rec->length, overhead+padding_length);
546     + /* The padding consists of a length byte at the end of the record and
547     + * then that many bytes of padding, all with the same value as the
548     + * length byte. Thus, with the length byte included, there are i+1
549     + * bytes of padding.
550     + *
551     + * We can't check just |padding_length+1| bytes because that leaks
552     + * decrypted information. Therefore we always have to check the maximum
553     + * amount of padding possible. (Again, the length of the record is
554     + * public information so we can use it.) */
555     + to_check = 255; /* maximum amount of padding. */
556     + if (to_check > rec->length-1)
557     + to_check = rec->length-1;
558     +
559     + for (i = 0; i < to_check; i++)
560     + {
561     + unsigned char mask = constant_time_ge(padding_length, i);
562     + unsigned char b = rec->data[rec->length-1-i];
563     + /* The final |padding_length+1| bytes should all have the value
564     + * |padding_length|. Therefore the XOR should be zero. */
565     + good &= ~(mask&(padding_length ^ b));
566     + }
567     +
568     + /* If any of the final |padding_length+1| bytes had the wrong value,
569     + * one or more of the lower eight bits of |good| will be cleared. We
570     + * AND the bottom 8 bits together and duplicate the result to all the
571     + * bits. */
572     + good &= good >> 4;
573     + good &= good >> 2;
574     + good &= good >> 1;
575     + good <<= sizeof(good)*8-1;
576     + good = DUPLICATE_MSB_TO_ALL(good);
577     +
578     + padding_length = good & (padding_length+1);
579     + rec->length -= padding_length;
580     + rec->type |= padding_length<<8; /* kludge: pass padding length */
581     +
582     + return (int)((good & 1) | (~good & -1));
583     + }
584     +
585     +/* ssl3_cbc_copy_mac copies |md_size| bytes from the end of |rec| to |out| in
586     + * constant time (independent of the concrete value of rec->length, which may
587     + * vary within a 256-byte window).
588     + *
589     + * ssl3_cbc_remove_padding or tls1_cbc_remove_padding must be called prior to
590     + * this function.
591     + *
592     + * On entry:
593     + * rec->orig_len >= md_size
594     + * md_size <= EVP_MAX_MD_SIZE
595     + *
596     + * If CBC_MAC_ROTATE_IN_PLACE is defined then the rotation is performed with
597     + * variable accesses in a 64-byte-aligned buffer. Assuming that this fits into
598     + * a single or pair of cache-lines, then the variable memory accesses don't
599     + * actually affect the timing. CPUs with smaller cache-lines [if any] are
600     + * not multi-core and are not considered vulnerable to cache-timing attacks.
601     + */
602     +#define CBC_MAC_ROTATE_IN_PLACE
603     +
604     +void ssl3_cbc_copy_mac(unsigned char* out,
605     + const SSL3_RECORD *rec,
606     + unsigned md_size,unsigned orig_len)
607     + {
608     +#if defined(CBC_MAC_ROTATE_IN_PLACE)
609     + unsigned char rotated_mac_buf[64+EVP_MAX_MD_SIZE];
610     + unsigned char *rotated_mac;
611     +#else
612     + unsigned char rotated_mac[EVP_MAX_MD_SIZE];
613     +#endif
614     +
615     + /* mac_end is the index of |rec->data| just after the end of the MAC. */
616     + unsigned mac_end = rec->length;
617     + unsigned mac_start = mac_end - md_size;
618     + /* scan_start contains the number of bytes that we can ignore because
619     + * the MAC's position can only vary by 255 bytes. */
620     + unsigned scan_start = 0;
621     + unsigned i, j;
622     + unsigned div_spoiler;
623     + unsigned rotate_offset;
624     +
625     + OPENSSL_assert(orig_len >= md_size);
626     + OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE);
627     +
628     +#if defined(CBC_MAC_ROTATE_IN_PLACE)
629     + rotated_mac = rotated_mac_buf + ((0-(size_t)rotated_mac_buf)&63);
630     +#endif
631     +
632     + /* This information is public so it's safe to branch based on it. */
633     + if (orig_len > md_size + 255 + 1)
634     + scan_start = orig_len - (md_size + 255 + 1);
635     + /* div_spoiler contains a multiple of md_size that is used to cause the
636     + * modulo operation to be constant time. Without this, the time varies
637     + * based on the amount of padding when running on Intel chips at least.
638     + *
639     + * The aim of right-shifting md_size is so that the compiler doesn't
640     + * figure out that it can remove div_spoiler as that would require it
641     + * to prove that md_size is always even, which I hope is beyond it. */
642     + div_spoiler = md_size >> 1;
643     + div_spoiler <<= (sizeof(div_spoiler)-1)*8;
644     + rotate_offset = (div_spoiler + mac_start - scan_start) % md_size;
645     +
646     + memset(rotated_mac, 0, md_size);
647     + for (i = scan_start, j = 0; i < orig_len; i++)
648     + {
649     + unsigned char mac_started = constant_time_ge(i, mac_start);
650     + unsigned char mac_ended = constant_time_ge(i, mac_end);
651     + unsigned char b = rec->data[i];
652     + rotated_mac[j++] |= b & mac_started & ~mac_ended;
653     + j &= constant_time_lt(j,md_size);
654     + }
655     +
656     + /* Now rotate the MAC */
657     +#if defined(CBC_MAC_ROTATE_IN_PLACE)
658     + j = 0;
659     + for (i = 0; i < md_size; i++)
660     + {
661     + /* in case cache-line is 32 bytes, touch second line */
662     + ((volatile unsigned char *)rotated_mac)[rotate_offset^32];
663     + out[j++] = rotated_mac[rotate_offset++];
664     + rotate_offset &= constant_time_lt(rotate_offset,md_size);
665     + }
666     +#else
667     + memset(out, 0, md_size);
668     + rotate_offset = md_size - rotate_offset;
669     + rotate_offset &= constant_time_lt(rotate_offset,md_size);
670     + for (i = 0; i < md_size; i++)
671     + {
672     + for (j = 0; j < md_size; j++)
673     + out[j] |= rotated_mac[i] & constant_time_eq_8(j, rotate_offset);
674     + rotate_offset++;
675     + rotate_offset &= constant_time_lt(rotate_offset,md_size);
676     + }
677     +#endif
678     + }
679     +
680     +/* u32toLE serialises an unsigned, 32-bit number (n) as four bytes at (p) in
681     + * little-endian order. The value of p is advanced by four. */
682     +#define u32toLE(n, p) \
683     + (*((p)++)=(unsigned char)(n), \
684     + *((p)++)=(unsigned char)(n>>8), \
685     + *((p)++)=(unsigned char)(n>>16), \
686     + *((p)++)=(unsigned char)(n>>24))
687     +
688     +/* These functions serialize the state of a hash and thus perform the standard
689     + * "final" operation without adding the padding and length that such a function
690     + * typically does. */
691     +static void tls1_md5_final_raw(void* ctx, unsigned char *md_out)
692     + {
693     + MD5_CTX *md5 = ctx;
694     + u32toLE(md5->A, md_out);
695     + u32toLE(md5->B, md_out);
696     + u32toLE(md5->C, md_out);
697     + u32toLE(md5->D, md_out);
698     + }
699     +
700     +static void tls1_sha1_final_raw(void* ctx, unsigned char *md_out)
701     + {
702     + SHA_CTX *sha1 = ctx;
703     + l2n(sha1->h0, md_out);
704     + l2n(sha1->h1, md_out);
705     + l2n(sha1->h2, md_out);
706     + l2n(sha1->h3, md_out);
707     + l2n(sha1->h4, md_out);
708     + }
709     +#define LARGEST_DIGEST_CTX SHA_CTX
710     +
711     +#ifndef OPENSSL_NO_SHA256
712     +static void tls1_sha256_final_raw(void* ctx, unsigned char *md_out)
713     + {
714     + SHA256_CTX *sha256 = ctx;
715     + unsigned i;
716     +
717     + for (i = 0; i < 8; i++)
718     + {
719     + l2n(sha256->h[i], md_out);
720     + }
721     + }
722     +#undef LARGEST_DIGEST_CTX
723     +#define LARGEST_DIGEST_CTX SHA256_CTX
724     +#endif
725     +
726     +#ifndef OPENSSL_NO_SHA512
727     +static void tls1_sha512_final_raw(void* ctx, unsigned char *md_out)
728     + {
729     + SHA512_CTX *sha512 = ctx;
730     + unsigned i;
731     +
732     + for (i = 0; i < 8; i++)
733     + {
734     + l2n8(sha512->h[i], md_out);
735     + }
736     + }
737     +#undef LARGEST_DIGEST_CTX
738     +#define LARGEST_DIGEST_CTX SHA512_CTX
739     +#endif
740     +
741     +/* ssl3_cbc_record_digest_supported returns 1 iff |ctx| uses a hash function
742     + * which ssl3_cbc_digest_record supports. */
743     +char ssl3_cbc_record_digest_supported(const EVP_MD *digest)
744     + {
745     +#ifdef OPENSSL_FIPS
746     + if (FIPS_mode())
747     + return 0;
748     +#endif
749     + switch (EVP_MD_type(digest))
750     + {
751     + case NID_md5:
752     + case NID_sha1:
753     +#ifndef OPENSSL_NO_SHA256
754     + case NID_sha224:
755     + case NID_sha256:
756     +#endif
757     +#ifndef OPENSSL_NO_SHA512
758     + case NID_sha384:
759     + case NID_sha512:
760     +#endif
761     + return 1;
762     + default:
763     + return 0;
764     + }
765     + }
766     +
767     +/* ssl3_cbc_digest_record computes the MAC of a decrypted, padded SSLv3/TLS
768     + * record.
769     + *
770     + * ctx: the EVP_MD_CTX from which we take the hash function.
771     + * ssl3_cbc_record_digest_supported must return true for this EVP_MD_CTX.
772     + * md_out: the digest output. At most EVP_MAX_MD_SIZE bytes will be written.
773     + * md_out_size: if non-NULL, the number of output bytes is written here.
774     + * header: the 13-byte, TLS record header.
775     + * data: the record data itself, less any preceeding explicit IV.
776     + * data_plus_mac_size: the secret, reported length of the data and MAC
777     + * once the padding has been removed.
778     + * data_plus_mac_plus_padding_size: the public length of the whole
779     + * record, including padding.
780     + * is_sslv3: non-zero if we are to use SSLv3. Otherwise, TLS.
781     + *
782     + * On entry: by virtue of having been through one of the remove_padding
783     + * functions, above, we know that data_plus_mac_size is large enough to contain
784     + * a padding byte and MAC. (If the padding was invalid, it might contain the
785     + * padding too. ) */
786     +void ssl3_cbc_digest_record(
787     + const EVP_MD *digest,
788     + unsigned char* md_out,
789     + size_t* md_out_size,
790     + const unsigned char header[13],
791     + const unsigned char *data,
792     + size_t data_plus_mac_size,
793     + size_t data_plus_mac_plus_padding_size,
794     + const unsigned char *mac_secret,
795     + unsigned mac_secret_length,
796     + char is_sslv3)
797     + {
798     + union { double align;
799     + unsigned char c[sizeof(LARGEST_DIGEST_CTX)]; } md_state;
800     + void (*md_final_raw)(void *ctx, unsigned char *md_out);
801     + void (*md_transform)(void *ctx, const unsigned char *block);
802     + unsigned md_size, md_block_size = 64;
803     + unsigned sslv3_pad_length = 40, header_length, variance_blocks,
804     + len, max_mac_bytes, num_blocks,
805     + num_starting_blocks, k, mac_end_offset, c, index_a, index_b;
806     + unsigned int bits; /* at most 18 bits */
807     + unsigned char length_bytes[MAX_HASH_BIT_COUNT_BYTES];
808     + /* hmac_pad is the masked HMAC key. */
809     + unsigned char hmac_pad[MAX_HASH_BLOCK_SIZE];
810     + unsigned char first_block[MAX_HASH_BLOCK_SIZE];
811     + unsigned char mac_out[EVP_MAX_MD_SIZE];
812     + unsigned i, j, md_out_size_u;
813     + EVP_MD_CTX md_ctx;
814     + /* mdLengthSize is the number of bytes in the length field that terminates
815     + * the hash. */
816     + unsigned md_length_size = 8;
817     + char length_is_big_endian = 1;
818     +
819     + /* This is a, hopefully redundant, check that allows us to forget about
820     + * many possible overflows later in this function. */
821     + OPENSSL_assert(data_plus_mac_plus_padding_size < 1024*1024);
822     +
823     + switch (EVP_MD_type(digest))
824     + {
825     + case NID_md5:
826     + MD5_Init((MD5_CTX*)md_state.c);
827     + md_final_raw = tls1_md5_final_raw;
828     + md_transform = (void(*)(void *ctx, const unsigned char *block)) MD5_Transform;
829     + md_size = 16;
830     + sslv3_pad_length = 48;
831     + length_is_big_endian = 0;
832     + break;
833     + case NID_sha1:
834     + SHA1_Init((SHA_CTX*)md_state.c);
835     + md_final_raw = tls1_sha1_final_raw;
836     + md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA1_Transform;
837     + md_size = 20;
838     + break;
839     +#ifndef OPENSSL_NO_SHA256
840     + case NID_sha224:
841     + SHA224_Init((SHA256_CTX*)md_state.c);
842     + md_final_raw = tls1_sha256_final_raw;
843     + md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA256_Transform;
844     + md_size = 224/8;
845     + break;
846     + case NID_sha256:
847     + SHA256_Init((SHA256_CTX*)md_state.c);
848     + md_final_raw = tls1_sha256_final_raw;
849     + md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA256_Transform;
850     + md_size = 32;
851     + break;
852     +#endif
853     +#ifndef OPENSSL_NO_SHA512
854     + case NID_sha384:
855     + SHA384_Init((SHA512_CTX*)md_state.c);
856     + md_final_raw = tls1_sha512_final_raw;
857     + md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA512_Transform;
858     + md_size = 384/8;
859     + md_block_size = 128;
860     + md_length_size = 16;
861     + break;
862     + case NID_sha512:
863     + SHA512_Init((SHA512_CTX*)md_state.c);
864     + md_final_raw = tls1_sha512_final_raw;
865     + md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA512_Transform;
866     + md_size = 64;
867     + md_block_size = 128;
868     + md_length_size = 16;
869     + break;
870     +#endif
871     + default:
872     + /* ssl3_cbc_record_digest_supported should have been
873     + * called first to check that the hash function is
874     + * supported. */
875     + OPENSSL_assert(0);
876     + if (md_out_size)
877     + *md_out_size = -1;
878     + return;
879     + }
880     +
881     + OPENSSL_assert(md_length_size <= MAX_HASH_BIT_COUNT_BYTES);
882     + OPENSSL_assert(md_block_size <= MAX_HASH_BLOCK_SIZE);
883     + OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE);
884     +
885     + header_length = 13;
886     + if (is_sslv3)
887     + {
888     + header_length =
889     + mac_secret_length +
890     + sslv3_pad_length +
891     + 8 /* sequence number */ +
892     + 1 /* record type */ +
893     + 2 /* record length */;
894     + }
895     +
896     + /* variance_blocks is the number of blocks of the hash that we have to
897     + * calculate in constant time because they could be altered by the
898     + * padding value.
899     + *
900     + * In SSLv3, the padding must be minimal so the end of the plaintext
901     + * varies by, at most, 15+20 = 35 bytes. (We conservatively assume that
902     + * the MAC size varies from 0..20 bytes.) In case the 9 bytes of hash
903     + * termination (0x80 + 64-bit length) don't fit in the final block, we
904     + * say that the final two blocks can vary based on the padding.
905     + *
906     + * TLSv1 has MACs up to 48 bytes long (SHA-384) and the padding is not
907     + * required to be minimal. Therefore we say that the final six blocks
908     + * can vary based on the padding.
909     + *
910     + * Later in the function, if the message is short and there obviously
911     + * cannot be this many blocks then variance_blocks can be reduced. */
912     + variance_blocks = is_sslv3 ? 2 : 6;
913     + /* From now on we're dealing with the MAC, which conceptually has 13
914     + * bytes of `header' before the start of the data (TLS) or 71/75 bytes
915     + * (SSLv3) */
916     + len = data_plus_mac_plus_padding_size + header_length;
917     + /* max_mac_bytes contains the maximum bytes of bytes in the MAC, including
918     + * |header|, assuming that there's no padding. */
919     + max_mac_bytes = len - md_size - 1;
920     + /* num_blocks is the maximum number of hash blocks. */
921     + num_blocks = (max_mac_bytes + 1 + md_length_size + md_block_size - 1) / md_block_size;
922     + /* In order to calculate the MAC in constant time we have to handle
923     + * the final blocks specially because the padding value could cause the
924     + * end to appear somewhere in the final |variance_blocks| blocks and we
925     + * can't leak where. However, |num_starting_blocks| worth of data can
926     + * be hashed right away because no padding value can affect whether
927     + * they are plaintext. */
928     + num_starting_blocks = 0;
929     + /* k is the starting byte offset into the conceptual header||data where
930     + * we start processing. */
931     + k = 0;
932     + /* mac_end_offset is the index just past the end of the data to be
933     + * MACed. */
934     + mac_end_offset = data_plus_mac_size + header_length - md_size;
935     + /* c is the index of the 0x80 byte in the final hash block that
936     + * contains application data. */
937     + c = mac_end_offset % md_block_size;
938     + /* index_a is the hash block number that contains the 0x80 terminating
939     + * value. */
940     + index_a = mac_end_offset / md_block_size;
941     + /* index_b is the hash block number that contains the 64-bit hash
942     + * length, in bits. */
943     + index_b = (mac_end_offset + md_length_size) / md_block_size;
944     + /* bits is the hash-length in bits. It includes the additional hash
945     + * block for the masked HMAC key, or whole of |header| in the case of
946     + * SSLv3. */
947     +
948     + /* For SSLv3, if we're going to have any starting blocks then we need
949     + * at least two because the header is larger than a single block. */
950     + if (num_blocks > variance_blocks + (is_sslv3 ? 1 : 0))
951     + {
952     + num_starting_blocks = num_blocks - variance_blocks;
953     + k = md_block_size*num_starting_blocks;
954     + }
955     +
956     + bits = 8*mac_end_offset;
957     + if (!is_sslv3)
958     + {
959     + /* Compute the initial HMAC block. For SSLv3, the padding and
960     + * secret bytes are included in |header| because they take more
961     + * than a single block. */
962     + bits += 8*md_block_size;
963     + memset(hmac_pad, 0, md_block_size);
964     + OPENSSL_assert(mac_secret_length <= sizeof(hmac_pad));
965     + memcpy(hmac_pad, mac_secret, mac_secret_length);
966     + for (i = 0; i < md_block_size; i++)
967     + hmac_pad[i] ^= 0x36;
968     +
969     + md_transform(md_state.c, hmac_pad);
970     + }
971     +
972     + if (length_is_big_endian)
973     + {
974     + memset(length_bytes,0,md_length_size-4);
975     + length_bytes[md_length_size-4] = (unsigned char)(bits>>24);
976     + length_bytes[md_length_size-3] = (unsigned char)(bits>>16);
977     + length_bytes[md_length_size-2] = (unsigned char)(bits>>8);
978     + length_bytes[md_length_size-1] = (unsigned char)bits;
979     + }
980     + else
981     + {
982     + memset(length_bytes,0,md_length_size);
983     + length_bytes[md_length_size-5] = (unsigned char)(bits>>24);
984     + length_bytes[md_length_size-6] = (unsigned char)(bits>>16);
985     + length_bytes[md_length_size-7] = (unsigned char)(bits>>8);
986     + length_bytes[md_length_size-8] = (unsigned char)bits;
987     + }
988     +
989     + if (k > 0)
990     + {
991     + if (is_sslv3)
992     + {
993     + /* The SSLv3 header is larger than a single block.
994     + * overhang is the number of bytes beyond a single
995     + * block that the header consumes: either 7 bytes
996     + * (SHA1) or 11 bytes (MD5). */
997     + unsigned overhang = header_length-md_block_size;
998     + md_transform(md_state.c, header);
999     + memcpy(first_block, header + md_block_size, overhang);
1000     + memcpy(first_block + overhang, data, md_block_size-overhang);
1001     + md_transform(md_state.c, first_block);
1002     + for (i = 1; i < k/md_block_size - 1; i++)
1003     + md_transform(md_state.c, data + md_block_size*i - overhang);
1004     + }
1005     + else
1006     + {
1007     + /* k is a multiple of md_block_size. */
1008     + memcpy(first_block, header, 13);
1009     + memcpy(first_block+13, data, md_block_size-13);
1010     + md_transform(md_state.c, first_block);
1011     + for (i = 1; i < k/md_block_size; i++)
1012     + md_transform(md_state.c, data + md_block_size*i - 13);
1013     + }
1014     + }
1015     +
1016     + memset(mac_out, 0, sizeof(mac_out));
1017     +
1018     + /* We now process the final hash blocks. For each block, we construct
1019     + * it in constant time. If the |i==index_a| then we'll include the 0x80
1020     + * bytes and zero pad etc. For each block we selectively copy it, in
1021     + * constant time, to |mac_out|. */
1022     + for (i = num_starting_blocks; i <= num_starting_blocks+variance_blocks; i++)
1023     + {
1024     + unsigned char block[MAX_HASH_BLOCK_SIZE];
1025     + unsigned char is_block_a = constant_time_eq_8(i, index_a);
1026     + unsigned char is_block_b = constant_time_eq_8(i, index_b);
1027     + for (j = 0; j < md_block_size; j++)
1028     + {
1029     + unsigned char b = 0, is_past_c, is_past_cp1;
1030     + if (k < header_length)
1031     + b = header[k];
1032     + else if (k < data_plus_mac_plus_padding_size + header_length)
1033     + b = data[k-header_length];
1034     + k++;
1035     +
1036     + is_past_c = is_block_a & constant_time_ge(j, c);
1037     + is_past_cp1 = is_block_a & constant_time_ge(j, c+1);
1038     + /* If this is the block containing the end of the
1039     + * application data, and we are at the offset for the
1040     + * 0x80 value, then overwrite b with 0x80. */
1041     + b = (b&~is_past_c) | (0x80&is_past_c);
1042     + /* If this the the block containing the end of the
1043     + * application data and we're past the 0x80 value then
1044     + * just write zero. */
1045     + b = b&~is_past_cp1;
1046     + /* If this is index_b (the final block), but not
1047     + * index_a (the end of the data), then the 64-bit
1048     + * length didn't fit into index_a and we're having to
1049     + * add an extra block of zeros. */
1050     + b &= ~is_block_b | is_block_a;
1051     +
1052     + /* The final bytes of one of the blocks contains the
1053     + * length. */
1054     + if (j >= md_block_size - md_length_size)
1055     + {
1056     + /* If this is index_b, write a length byte. */
1057     + b = (b&~is_block_b) | (is_block_b&length_bytes[j-(md_block_size-md_length_size)]);
1058     + }
1059     + block[j] = b;
1060     + }
1061     +
1062     + md_transform(md_state.c, block);
1063     + md_final_raw(md_state.c, block);
1064     + /* If this is index_b, copy the hash value to |mac_out|. */
1065     + for (j = 0; j < md_size; j++)
1066     + mac_out[j] |= block[j]&is_block_b;
1067     + }
1068     +
1069     + EVP_MD_CTX_init(&md_ctx);
1070     + EVP_DigestInit_ex(&md_ctx, digest, NULL /* engine */);
1071     + if (is_sslv3)
1072     + {
1073     + /* We repurpose |hmac_pad| to contain the SSLv3 pad2 block. */
1074     + memset(hmac_pad, 0x5c, sslv3_pad_length);
1075     +
1076     + EVP_DigestUpdate(&md_ctx, mac_secret, mac_secret_length);
1077     + EVP_DigestUpdate(&md_ctx, hmac_pad, sslv3_pad_length);
1078     + EVP_DigestUpdate(&md_ctx, mac_out, md_size);
1079     + }
1080     + else
1081     + {
1082     + /* Complete the HMAC in the standard manner. */
1083     + for (i = 0; i < md_block_size; i++)
1084     + hmac_pad[i] ^= 0x6a;
1085     +
1086     + EVP_DigestUpdate(&md_ctx, hmac_pad, md_block_size);
1087     + EVP_DigestUpdate(&md_ctx, mac_out, md_size);
1088     + }
1089     + EVP_DigestFinal(&md_ctx, md_out, &md_out_size_u);
1090     + if (md_out_size)
1091     + *md_out_size = md_out_size_u;
1092     + EVP_MD_CTX_cleanup(&md_ctx);
1093     + }
1094     +
1095     +#ifdef OPENSSL_FIPS
1096     +
1097     +/* Due to the need to use EVP in FIPS mode we can't reimplement digests but
1098     + * we can ensure the number of blocks processed is equal for all cases
1099     + * by digesting additional data.
1100     + */
1101     +
1102     +void tls_fips_digest_extra(
1103     + const EVP_CIPHER_CTX *cipher_ctx, const EVP_MD *hash, HMAC_CTX *hctx,
1104     + const unsigned char *data, size_t data_len, size_t orig_len)
1105     + {
1106     + size_t block_size, digest_pad, blocks_data, blocks_orig;
1107     + if (EVP_CIPHER_CTX_mode(cipher_ctx) != EVP_CIPH_CBC_MODE)
1108     + return;
1109     + block_size = EVP_MD_block_size(hash);
1110     + /* We are in FIPS mode if we get this far so we know we have only SHA*
1111     + * digests and TLS to deal with.
1112     + * Minimum digest padding length is 17 for SHA384/SHA512 and 9
1113     + * otherwise.
1114     + * Additional header is 13 bytes. To get the number of digest blocks
1115     + * processed round up the amount of data plus padding to the nearest
1116     + * block length. Block length is 128 for SHA384/SHA512 and 64 otherwise.
1117     + * So we have:
1118     + * blocks = (payload_len + digest_pad + 13 + block_size - 1)/block_size
1119     + * equivalently:
1120     + * blocks = (payload_len + digest_pad + 12)/block_size + 1
1121     + * HMAC adds a constant overhead.
1122     + * We're ultimately only interested in differences so this becomes
1123     + * blocks = (payload_len + 29)/128
1124     + * for SHA384/SHA512 and
1125     + * blocks = (payload_len + 21)/64
1126     + * otherwise.
1127     + */
1128     + digest_pad = block_size == 64 ? 21 : 29;
1129     + blocks_orig = (orig_len + digest_pad)/block_size;
1130     + blocks_data = (data_len + digest_pad)/block_size;
1131     + /* MAC enough blocks to make up the difference between the original
1132     + * and actual lengths plus one extra block to ensure this is never a
1133     + * no op. The "data" pointer should always have enough space to
1134     + * perform this operation as it is large enough for a maximum
1135     + * length TLS buffer.
1136     + */
1137     + HMAC_Update(hctx, data,
1138     + (blocks_orig - blocks_data + 1) * block_size);
1139     + }
1140     +#endif
1141     diff -up openssl-fips-0.9.8e/ssl/s3_enc.c.lucky13 openssl-fips-0.9.8e/ssl/s3_enc.c
1142     --- openssl-fips-0.9.8e/ssl/s3_enc.c.lucky13 2013-02-25 14:56:11.285381591 +0100
1143     +++ openssl-fips-0.9.8e/ssl/s3_enc.c 2013-02-25 14:56:11.407381902 +0100
1144     @@ -434,12 +434,21 @@ void ssl3_cleanup_key_block(SSL *s)
1145     s->s3->tmp.key_block_length=0;
1146     }
1147    
1148     +/* ssl3_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
1149     + *
1150     + * Returns:
1151     + * 0: (in non-constant time) if the record is publically invalid (i.e. too
1152     + * short etc).
1153     + * 1: if the record's padding is valid / the encryption was successful.
1154     + * -1: if the record's padding is invalid or, if sending, an internal error
1155     + * occured.
1156     + */
1157     int ssl3_enc(SSL *s, int send)
1158     {
1159     SSL3_RECORD *rec;
1160     EVP_CIPHER_CTX *ds;
1161     unsigned long l;
1162     - int bs,i;
1163     + int bs,i,mac_size=0;
1164     const EVP_CIPHER *enc;
1165    
1166     if (send)
1167     @@ -490,32 +499,17 @@ int ssl3_enc(SSL *s, int send)
1168     if (!send)
1169     {
1170     if (l == 0 || l%bs != 0)
1171     - {
1172     - SSLerr(SSL_F_SSL3_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
1173     - ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED);
1174     return 0;
1175     - }
1176     /* otherwise, rec->length >= bs */
1177     }
1178    
1179     EVP_Cipher(ds,rec->data,rec->input,l);
1180    
1181     + if (s->read_hash != NULL)
1182     + mac_size = EVP_MD_size(s->read_hash);
1183     +
1184     if ((bs != 1) && !send)
1185     - {
1186     - i=rec->data[l-1]+1;
1187     - /* SSL 3.0 bounds the number of padding bytes by the block size;
1188     - * padding bytes (except the last one) are arbitrary */
1189     - if (i > bs)
1190     - {
1191     - /* Incorrect padding. SSLerr() and ssl3_alert are done
1192     - * by caller: we don't want to reveal whether this is
1193     - * a decryption error or a MAC verification failure
1194     - * (see http://www.openssl.org/~bodo/tls-cbc.txt) */
1195     - return -1;
1196     - }
1197     - /* now i <= bs <= rec->length */
1198     - rec->length-=i;
1199     - }
1200     + return ssl3_cbc_remove_padding(s, rec, bs, mac_size);
1201     }
1202     return(1);
1203     }
1204     @@ -592,7 +586,7 @@ int ssl3_mac(SSL *ssl, unsigned char *md
1205     EVP_MD_CTX md_ctx;
1206     const EVP_MD *hash;
1207     unsigned char *p,rec_char;
1208     - unsigned int md_size;
1209     + size_t md_size, orig_len;
1210     int npad;
1211    
1212     if (send)
1213     @@ -613,28 +607,72 @@ int ssl3_mac(SSL *ssl, unsigned char *md
1214     md_size=EVP_MD_size(hash);
1215     npad=(48/md_size)*md_size;
1216    
1217     - /* Chop the digest off the end :-) */
1218     - EVP_MD_CTX_init(&md_ctx);
1219     -
1220     - EVP_DigestInit_ex( &md_ctx,hash, NULL);
1221     - EVP_DigestUpdate(&md_ctx,mac_sec,md_size);
1222     - EVP_DigestUpdate(&md_ctx,ssl3_pad_1,npad);
1223     - EVP_DigestUpdate(&md_ctx,seq,8);
1224     - rec_char=rec->type;
1225     - EVP_DigestUpdate(&md_ctx,&rec_char,1);
1226     - p=md;
1227     - s2n(rec->length,p);
1228     - EVP_DigestUpdate(&md_ctx,md,2);
1229     - EVP_DigestUpdate(&md_ctx,rec->input,rec->length);
1230     - EVP_DigestFinal_ex( &md_ctx,md,NULL);
1231     -
1232     - EVP_DigestInit_ex( &md_ctx,hash, NULL);
1233     - EVP_DigestUpdate(&md_ctx,mac_sec,md_size);
1234     - EVP_DigestUpdate(&md_ctx,ssl3_pad_2,npad);
1235     - EVP_DigestUpdate(&md_ctx,md,md_size);
1236     - EVP_DigestFinal_ex( &md_ctx,md,&md_size);
1237     + /* kludge: ssl3_cbc_remove_padding passes padding length in rec->type */
1238     + orig_len = rec->length+md_size+((unsigned int)rec->type>>8);
1239     + rec->type &= 0xff;
1240     +
1241     + if (!send &&
1242     + EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
1243     + ssl3_cbc_record_digest_supported(hash))
1244     + {
1245     + /* This is a CBC-encrypted record. We must avoid leaking any
1246     + * timing-side channel information about how many blocks of
1247     + * data we are hashing because that gives an attacker a
1248     + * timing-oracle. */
1249     +
1250     + /* npad is, at most, 48 bytes and that's with MD5:
1251     + * 16 + 48 + 8 (sequence bytes) + 1 + 2 = 75.
1252     + *
1253     + * With SHA-1 (the largest hash speced for SSLv3) the hash size
1254     + * goes up 4, but npad goes down by 8, resulting in a smaller
1255     + * total size. */
1256     + unsigned char header[75];
1257     + unsigned j = 0;
1258     + memcpy(header+j, mac_sec, md_size);
1259     + j += md_size;
1260     + memcpy(header+j, ssl3_pad_1, npad);
1261     + j += npad;
1262     + memcpy(header+j, seq, 8);
1263     + j += 8;
1264     + header[j++] = rec->type;
1265     + header[j++] = rec->length >> 8;
1266     + header[j++] = rec->length & 0xff;
1267     +
1268     + ssl3_cbc_digest_record(
1269     + hash,
1270     + md, &md_size,
1271     + header, rec->input,
1272     + rec->length + md_size, orig_len,
1273     + mac_sec, md_size,
1274     + 1 /* is SSLv3 */);
1275     + }
1276     + else
1277     + {
1278     + unsigned int md_size_u;
1279     + /* Chop the digest off the end :-) */
1280     + EVP_MD_CTX_init(&md_ctx);
1281     +
1282     + EVP_DigestInit_ex( &md_ctx,hash, NULL);
1283     + EVP_DigestUpdate(&md_ctx,mac_sec,md_size);
1284     + EVP_DigestUpdate(&md_ctx,ssl3_pad_1,npad);
1285     + EVP_DigestUpdate(&md_ctx,seq,8);
1286     + rec_char=rec->type;
1287     + EVP_DigestUpdate(&md_ctx,&rec_char,1);
1288     + p=md;
1289     + s2n(rec->length,p);
1290     + EVP_DigestUpdate(&md_ctx,md,2);
1291     + EVP_DigestUpdate(&md_ctx,rec->input,rec->length);
1292     + EVP_DigestFinal_ex( &md_ctx,md,NULL);
1293     +
1294     + EVP_DigestInit_ex( &md_ctx,hash, NULL);
1295     + EVP_DigestUpdate(&md_ctx,mac_sec,md_size);
1296     + EVP_DigestUpdate(&md_ctx,ssl3_pad_2,npad);
1297     + EVP_DigestUpdate(&md_ctx,md,md_size);
1298     + EVP_DigestFinal_ex( &md_ctx,md,&md_size_u);
1299     + md_size = md_size_u;
1300    
1301     - EVP_MD_CTX_cleanup(&md_ctx);
1302     + EVP_MD_CTX_cleanup(&md_ctx);
1303     + }
1304    
1305     ssl3_record_sequence_update(seq);
1306     return(md_size);
1307     diff -up openssl-fips-0.9.8e/ssl/s3_pkt.c.lucky13 openssl-fips-0.9.8e/ssl/s3_pkt.c
1308     --- openssl-fips-0.9.8e/ssl/s3_pkt.c.lucky13 2013-02-25 14:56:11.225381423 +0100
1309     +++ openssl-fips-0.9.8e/ssl/s3_pkt.c 2013-02-25 14:56:11.408381905 +0100
1310     @@ -237,11 +237,8 @@ static int ssl3_get_record(SSL *s)
1311     unsigned char *p;
1312     unsigned char md[EVP_MAX_MD_SIZE];
1313     short version;
1314     - unsigned int mac_size;
1315     - int clear=0;
1316     + unsigned mac_size, orig_len;
1317     size_t extra;
1318     - int decryption_failed_or_bad_record_mac = 0;
1319     - unsigned char *mac = NULL;
1320    
1321     rr= &(s->s3->rrec);
1322     sess=s->session;
1323     @@ -347,17 +344,15 @@ again:
1324     rr->data=rr->input;
1325    
1326     enc_err = s->method->ssl3_enc->enc(s,0);
1327     - if (enc_err <= 0)
1328     + /* enc_err is:
1329     + * 0: (in non-constant time) if the record is publically invalid.
1330     + * 1: if the padding is valid
1331     + * -1: if the padding is invalid */
1332     + if (enc_err == 0)
1333     {
1334     - if (enc_err == 0)
1335     - /* SSLerr() and ssl3_send_alert() have been called */
1336     - goto err;
1337     -
1338     - /* Otherwise enc_err == -1, which indicates bad padding
1339     - * (rec->length has not been changed in this case).
1340     - * To minimize information leaked via timing, we will perform
1341     - * the MAC computation anyway. */
1342     - decryption_failed_or_bad_record_mac = 1;
1343     + al=SSL_AD_DECRYPTION_FAILED;
1344     + SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
1345     + goto f_err;
1346     }
1347    
1348     #ifdef TLS_DEBUG
1349     @@ -367,51 +362,62 @@ printf("\n");
1350     #endif
1351    
1352     /* r->length is now the compressed data plus mac */
1353     - if ( (sess == NULL) ||
1354     - (s->enc_read_ctx == NULL) ||
1355     - (s->read_hash == NULL))
1356     - clear=1;
1357     -
1358     - if (!clear)
1359     - {
1360     + if ((sess != NULL) &&
1361     + (s->enc_read_ctx != NULL) &&
1362     + (s->read_hash != NULL))
1363     + {
1364     + /* s->read_hash != NULL => mac_size != -1 */
1365     + unsigned char *mac = NULL;
1366     + unsigned char mac_tmp[EVP_MAX_MD_SIZE];
1367     mac_size=EVP_MD_size(s->read_hash);
1368     + OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);
1369    
1370     - if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra+mac_size)
1371     + /* kludge: *_cbc_remove_padding passes padding length in rr->type */
1372     + orig_len = rr->length+((unsigned int)rr->type>>8);
1373     +
1374     + /* orig_len is the length of the record before any padding was
1375     + * removed. This is public information, as is the MAC in use,
1376     + * therefore we can safely process the record in a different
1377     + * amount of time if it's too short to possibly contain a MAC.
1378     + */
1379     + if (orig_len < mac_size ||
1380     + /* CBC records must have a padding length byte too. */
1381     + (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
1382     + orig_len < mac_size+1))
1383     {
1384     -#if 0 /* OK only for stream ciphers (then rr->length is visible from ciphertext anyway) */
1385     - al=SSL_AD_RECORD_OVERFLOW;
1386     - SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);
1387     + al=SSL_AD_DECODE_ERROR;
1388     + SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT);
1389     goto f_err;
1390     -#else
1391     - decryption_failed_or_bad_record_mac = 1;
1392     -#endif
1393     }
1394     - /* check the MAC for rr->input (it's in mac_size bytes at the tail) */
1395     - if (rr->length >= mac_size)
1396     +
1397     + if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE)
1398     {
1399     + /* We update the length so that the TLS header bytes
1400     + * can be constructed correctly but we need to extract
1401     + * the MAC in constant time from within the record,
1402     + * without leaking the contents of the padding bytes.
1403     + * */
1404     + mac = mac_tmp;
1405     + ssl3_cbc_copy_mac(mac_tmp, rr, mac_size, orig_len);
1406     rr->length -= mac_size;
1407     - mac = &rr->data[rr->length];
1408     }
1409     else
1410     {
1411     - /* record (minus padding) is too short to contain a MAC */
1412     -#if 0 /* OK only for stream ciphers */
1413     - al=SSL_AD_DECODE_ERROR;
1414     - SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT);
1415     - goto f_err;
1416     -#else
1417     - decryption_failed_or_bad_record_mac = 1;
1418     - rr->length = 0;
1419     -#endif
1420     - }
1421     - i=s->method->ssl3_enc->mac(s,md,0);
1422     - if (mac == NULL || memcmp(md, mac, mac_size) != 0)
1423     - {
1424     - decryption_failed_or_bad_record_mac = 1;
1425     + /* In this case there's no padding, so |orig_len|
1426     + * equals |rec->length| and we checked that there's
1427     + * enough bytes for |mac_size| above. */
1428     + rr->length -= mac_size;
1429     + mac = &rr->data[rr->length];
1430     }
1431     +
1432     + i=s->method->ssl3_enc->mac(s,md,0 /* not send */);
1433     + if (i < 0 || mac == NULL || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0)
1434     + enc_err = -1;
1435     + if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra+mac_size)
1436     + enc_err = -1;
1437     }
1438    
1439     - if (decryption_failed_or_bad_record_mac)
1440     + if (enc_err < 0)
1441     {
1442     /* A separate 'decryption_failed' alert was introduced with TLS 1.0,
1443     * SSL 3.0 only has 'bad_record_mac'. But unless a decryption
1444     diff -up openssl-fips-0.9.8e/ssl/ssl_locl.h.lucky13 openssl-fips-0.9.8e/ssl/ssl_locl.h
1445     --- openssl-fips-0.9.8e/ssl/ssl_locl.h.lucky13 2013-02-25 14:56:11.219381406 +0100
1446     +++ openssl-fips-0.9.8e/ssl/ssl_locl.h 2013-02-25 14:57:27.348538698 +0100
1447     @@ -133,6 +133,7 @@
1448     #ifndef OPENSSL_NO_DSA
1449     #include <openssl/dsa.h>
1450     #endif
1451     +#include <openssl/hmac.h>
1452     #include <openssl/err.h>
1453     #include <openssl/ssl.h>
1454     #include <openssl/symhacks.h>
1455     @@ -187,6 +188,15 @@
1456     *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
1457     *((c)++)=(unsigned char)(((l) )&0xff))
1458    
1459     +#define l2n8(l,c) (*((c)++)=(unsigned char)(((l)>>56)&0xff), \
1460     + *((c)++)=(unsigned char)(((l)>>48)&0xff), \
1461     + *((c)++)=(unsigned char)(((l)>>40)&0xff), \
1462     + *((c)++)=(unsigned char)(((l)>>32)&0xff), \
1463     + *((c)++)=(unsigned char)(((l)>>24)&0xff), \
1464     + *((c)++)=(unsigned char)(((l)>>16)&0xff), \
1465     + *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
1466     + *((c)++)=(unsigned char)(((l) )&0xff))
1467     +
1468     #define n2l6(c,l) (l =((BN_ULLONG)(*((c)++)))<<40, \
1469     l|=((BN_ULLONG)(*((c)++)))<<32, \
1470     l|=((BN_ULLONG)(*((c)++)))<<24, \
1471     @@ -946,5 +956,33 @@ int ssl_add_clienthello_renegotiate_ext(
1472     int maxlen);
1473     int ssl_parse_clienthello_renegotiate_ext(SSL *s, unsigned char *d, int len,
1474     int *al);
1475     +/* s3_cbc.c */
1476     +void ssl3_cbc_copy_mac(unsigned char* out,
1477     + const SSL3_RECORD *rec,
1478     + unsigned md_size,unsigned orig_len);
1479     +int ssl3_cbc_remove_padding(const SSL* s,
1480     + SSL3_RECORD *rec,
1481     + unsigned block_size,
1482     + unsigned mac_size);
1483     +int tls1_cbc_remove_padding(const SSL* s,
1484     + SSL3_RECORD *rec,
1485     + unsigned block_size,
1486     + unsigned mac_size);
1487     +char ssl3_cbc_record_digest_supported(const EVP_MD *hash);
1488     +void ssl3_cbc_digest_record(
1489     + const EVP_MD *hash,
1490     + unsigned char* md_out,
1491     + size_t* md_out_size,
1492     + const unsigned char header[13],
1493     + const unsigned char *data,
1494     + size_t data_plus_mac_size,
1495     + size_t data_plus_mac_plus_padding_size,
1496     + const unsigned char *mac_secret,
1497     + unsigned mac_secret_length,
1498     + char is_sslv3);
1499     +
1500     +void tls_fips_digest_extra(
1501     + const EVP_CIPHER_CTX *cipher_ctx, const EVP_MD *hash, HMAC_CTX *hctx,
1502     + const unsigned char *data, size_t data_len, size_t orig_len);
1503    
1504     #endif
1505     diff -up openssl-fips-0.9.8e/ssl/t1_enc.c.lucky13 openssl-fips-0.9.8e/ssl/t1_enc.c
1506     --- openssl-fips-0.9.8e/ssl/t1_enc.c.lucky13 2013-02-25 14:56:11.027380889 +0100
1507     +++ openssl-fips-0.9.8e/ssl/t1_enc.c 2013-02-25 15:30:15.511540650 +0100
1508     @@ -523,18 +523,25 @@ err:
1509     return(0);
1510     }
1511    
1512     +/* tls1_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
1513     + *
1514     + * Returns:
1515     + * 0: (in non-constant time) if the record is publically invalid (i.e. too
1516     + * short etc).
1517     + * 1: if the record's padding is valid / the encryption was successful.
1518     + * -1: if the record's padding/AEAD-authenticator is invalid or, if sending,
1519     + * an internal error occured.
1520     + */
1521     int tls1_enc(SSL *s, int send)
1522     {
1523     SSL3_RECORD *rec;
1524     EVP_CIPHER_CTX *ds;
1525     unsigned long l;
1526     - int bs,i,ii,j,k,n=0;
1527     + int bs,i,j,k,pad=0,ret,mac_size=0;
1528     const EVP_CIPHER *enc;
1529    
1530     if (send)
1531     {
1532     - if (s->write_hash != NULL)
1533     - n=EVP_MD_size(s->write_hash);
1534     ds=s->enc_write_ctx;
1535     rec= &(s->s3->wrec);
1536     if (s->enc_write_ctx == NULL)
1537     @@ -544,8 +551,6 @@ int tls1_enc(SSL *s, int send)
1538     }
1539     else
1540     {
1541     - if (s->read_hash != NULL)
1542     - n=EVP_MD_size(s->read_hash);
1543     ds=s->enc_read_ctx;
1544     rec= &(s->s3->rrec);
1545     if (s->enc_read_ctx == NULL)
1546     @@ -558,11 +563,11 @@ int tls1_enc(SSL *s, int send)
1547     printf("tls1_enc(%d)\n", send);
1548     #endif /* KSSL_DEBUG */
1549    
1550     - if ((s->session == NULL) || (ds == NULL) ||
1551     - (enc == NULL))
1552     + if ((s->session == NULL) || (ds == NULL) || (enc == NULL))
1553     {
1554     memmove(rec->data,rec->input,rec->length);
1555     rec->input=rec->data;
1556     + ret = 1;
1557     }
1558     else
1559     {
1560     @@ -609,11 +614,7 @@ int tls1_enc(SSL *s, int send)
1561     if (!send)
1562     {
1563     if (l == 0 || l%bs != 0)
1564     - {
1565     - SSLerr(SSL_F_TLS1_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
1566     - ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED);
1567     return 0;
1568     - }
1569     }
1570    
1571     EVP_Cipher(ds,rec->data,rec->input,l);
1572     @@ -627,49 +628,15 @@ int tls1_enc(SSL *s, int send)
1573     }
1574     #endif /* KSSL_DEBUG */
1575    
1576     + ret = 1;
1577     + if (s->read_hash != NULL)
1578     + mac_size = EVP_MD_size(s->read_hash);
1579     if ((bs != 1) && !send)
1580     - {
1581     - ii=i=rec->data[l-1]; /* padding_length */
1582     - i++;
1583     - /* NB: if compression is in operation the first packet
1584     - * may not be of even length so the padding bug check
1585     - * cannot be performed. This bug workaround has been
1586     - * around since SSLeay so hopefully it is either fixed
1587     - * now or no buggy implementation supports compression
1588     - * [steve]
1589     - */
1590     - if ( (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG)
1591     - && !s->expand)
1592     - {
1593     - /* First packet is even in size, so check */
1594     - if ((memcmp(s->s3->read_sequence,
1595     - "\0\0\0\0\0\0\0\0",8) == 0) && !(ii & 1))
1596     - s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;
1597     - if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
1598     - i--;
1599     - }
1600     - /* TLS 1.0 does not bound the number of padding bytes by the block size.
1601     - * All of them must have value 'padding_length'. */
1602     - if (i > (int)rec->length)
1603     - {
1604     - /* Incorrect padding. SSLerr() and ssl3_alert are done
1605     - * by caller: we don't want to reveal whether this is
1606     - * a decryption error or a MAC verification failure
1607     - * (see http://www.openssl.org/~bodo/tls-cbc.txt) */
1608     - return -1;
1609     - }
1610     - for (j=(int)(l-i); j<(int)l; j++)
1611     - {
1612     - if (rec->data[j] != ii)
1613     - {
1614     - /* Incorrect padding */
1615     - return -1;
1616     - }
1617     - }
1618     - rec->length-=i;
1619     - }
1620     + ret = tls1_cbc_remove_padding(s, rec, bs, mac_size);
1621     + if (pad && !send)
1622     + rec->length -= pad;
1623     }
1624     - return(1);
1625     + return ret;
1626     }
1627    
1628     int tls1_cert_verify_mac(SSL *s, EVP_MD_CTX *in_ctx, unsigned char *out)
1629     @@ -717,10 +684,10 @@ int tls1_mac(SSL *ssl, unsigned char *md
1630     SSL3_RECORD *rec;
1631     unsigned char *mac_sec,*seq;
1632     const EVP_MD *hash;
1633     - unsigned int md_size;
1634     + size_t md_size, orig_len;
1635     int i;
1636     HMAC_CTX hmac;
1637     - unsigned char buf[5];
1638     + unsigned char header[13];
1639    
1640     if (send)
1641     {
1642     @@ -739,20 +706,6 @@ int tls1_mac(SSL *ssl, unsigned char *md
1643    
1644     md_size=EVP_MD_size(hash);
1645    
1646     - buf[0]=rec->type;
1647     - if (ssl->version == DTLS1_VERSION && ssl->client_version == DTLS1_BAD_VER)
1648     - {
1649     - buf[1]=TLS1_VERSION_MAJOR;
1650     - buf[2]=TLS1_VERSION_MINOR;
1651     - }
1652     - else {
1653     - buf[1]=(unsigned char)(ssl->version>>8);
1654     - buf[2]=(unsigned char)(ssl->version);
1655     - }
1656     -
1657     - buf[3]=rec->length>>8;
1658     - buf[4]=rec->length&0xff;
1659     -
1660     /* I should fix this up TLS TLS TLS TLS TLS XXXXXXXX */
1661     HMAC_CTX_init(&hmac);
1662     HMAC_Init_ex(&hmac,mac_sec,EVP_MD_size(hash),hash,NULL);
1663     @@ -764,16 +717,57 @@ int tls1_mac(SSL *ssl, unsigned char *md
1664     s2n(send?ssl->d1->w_epoch:ssl->d1->r_epoch, p);
1665     memcpy (p,&seq[2],6);
1666    
1667     - HMAC_Update(&hmac,dtlsseq,8);
1668     + memcpy(header, dtlsseq, 8);
1669     }
1670     else
1671     - HMAC_Update(&hmac,seq,8);
1672     + memcpy(header, seq, 8);
1673    
1674     - HMAC_Update(&hmac,buf,5);
1675     - HMAC_Update(&hmac,rec->input,rec->length);
1676     - HMAC_Final(&hmac,md,&md_size);
1677     - HMAC_CTX_cleanup(&hmac);
1678     + /* kludge: tls1_cbc_remove_padding passes padding length in rec->type */
1679     + orig_len = rec->length+md_size+((unsigned int)rec->type>>8);
1680     + rec->type &= 0xff;
1681     +
1682     + header[8]=rec->type;
1683     + header[9]=(unsigned char)(ssl->version>>8);
1684     + header[10]=(unsigned char)(ssl->version);
1685     + header[11]=(rec->length)>>8;
1686     + header[12]=(rec->length)&0xff;
1687     +
1688     + if (!send &&
1689     + EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
1690     + ssl3_cbc_record_digest_supported(hash))
1691     + {
1692     + /* This is a CBC-encrypted record. We must avoid leaking any
1693     + * timing-side channel information about how many blocks of
1694     + * data we are hashing because that gives an attacker a
1695     + * timing-oracle. */
1696     + ssl3_cbc_digest_record(
1697     + hash,
1698     + md, &md_size,
1699     + header, rec->input,
1700     + rec->length + md_size, orig_len,
1701     + ssl->s3->read_mac_secret,
1702     + EVP_MD_size(ssl->read_hash),
1703     + 0 /* not SSLv3 */);
1704     + }
1705     + else
1706     + {
1707     + unsigned mds;
1708    
1709     + HMAC_Update(&hmac,header,sizeof(header));
1710     + HMAC_Update(&hmac,rec->input,rec->length);
1711     + HMAC_Final(&hmac,md,&mds);
1712     + md_size = mds;
1713     +#ifdef OPENSSL_FIPS
1714     + if (!send && FIPS_mode())
1715     + tls_fips_digest_extra(
1716     + ssl->enc_read_ctx,
1717     + hash,
1718     + &hmac, rec->input,
1719     + rec->length, orig_len);
1720     +#endif
1721     + }
1722     +
1723     + HMAC_CTX_cleanup(&hmac);
1724     #ifdef TLS_DEBUG
1725     printf("sec=");
1726     {unsigned int z; for (z=0; z<md_size; z++) printf("%02X ",mac_sec[z]); printf("\n"); }
1727     diff -up openssl-fips-0.9.8e/test/testssl.lucky13 openssl-fips-0.9.8e/test/testssl
1728     --- openssl-fips-0.9.8e/test/testssl.lucky13 2005-02-02 00:48:36.000000000 +0100
1729     +++ openssl-fips-0.9.8e/test/testssl 2013-02-25 14:56:11.422381943 +0100
1730     @@ -119,6 +119,23 @@ $ssltest -bio_pair -server_auth -client_
1731     echo test sslv2/sslv3 with both client and server authentication via BIO pair and app verify
1732     $ssltest -bio_pair -server_auth -client_auth -app_verify $CA $extra || exit 1
1733    
1734     +echo "Testing ciphersuites"
1735     +for protocol in SSLv3; do
1736     + echo "Testing ciphersuites for $protocol"
1737     + for cipher in `../util/shlib_wrap.sh ../apps/openssl ciphers "RSA+$protocol" | tr ':' ' '`; do
1738     + echo "Testing $cipher"
1739     + prot=""
1740     + if [ $protocol == "SSLv3" ] ; then
1741     + prot="-ssl3"
1742     + fi
1743     + $ssltest -cipher $cipher $prot
1744     + if [ $? -ne 0 ] ; then
1745     + echo "Failed $cipher"
1746     + exit 1
1747     + fi
1748     + done
1749     +done
1750     +
1751     #############################################################################
1752    
1753     if ../util/shlib_wrap.sh ../apps/openssl no-dh; then
admin@koozali.org
 ViewVC Help
Powered by ViewVC 1.2.1 RSS 2.0 feed