kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
abbf365b6d
boringssl/ssl/tls_record.cc

701 lines
26 KiB
C++
Raw Normal View History

Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
/* ====================================================================
* Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* openssl-core@openssl.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com). */
#include <openssl/ssl.h>
#include <assert.h>
Tidy up keyblock and CCS logic slightly. Move the actual SSL_AEAD_CTX swap into the record layer. Also revise the intermediate state we store between setup_key_block and change_cipher_state. With SSL_AEAD_CTX_new abstracted out, keeping the EVP_AEAD around doesn't make much sense. Just store enough to partition the key block. Change-Id: I773fb46a2cb78fa570f00c0a89339c15bbb1d719 Reviewed-on: https://boringssl-review.googlesource.com/6832 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-12-25 20:34:23 +00:00
#include <string.h>
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
#include <openssl/bytestring.h>
#include <openssl/err.h>
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
#include <openssl/mem.h>
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
#include "internal.h"
Remove in-place TLS record assembly for now. Decrypting is very easy to do in-place, but encrypting in-place is a hassle. The rules actually were wrong due to record-splitting. The aliasing prefix and the alignment prefix actually differ by 1. Take it out for now in preparation for tightening the aliasing rules. If we decide to do in-place encrypt later, probably it'd be more useful to return header + in-place ciphertext + trailer. (That, in turn, needs a scatter/gather thing on the AEAD thanks to TLS 1.3's padding and record type construction.) We may also wish to rethink how record-splitting works here. Change-Id: I0187d39c541e76ef933b7c2c193323164fd8a156 Reviewed-on: https://boringssl-review.googlesource.com/8230 Reviewed-by: Adam Langley <agl@google.com>
2016-06-08 23:31:24 +01:00
#include "../crypto/internal.h"
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
Move libssl's internals into the bssl namespace. This is horrible, but everything else I tried was worse. The goal with this CL is to take the extern "C" out of ssl/internal.h and move most symbols to namespace bssl, so we can start using C++ helpers and destructors without worry. Complications: - Public API functions must be extern "C" and match their declaration in ssl.h, which is unnamespaced. C++ really does not want you to interleave namespaced and unnamespaced things. One can actually write a namespaced extern "C" function, but this means, from C++'s perspective, the function is namespaced. Trying to namespace the public header would worked but ended up too deep a rabbithole. - Our STACK_OF macros do not work right in namespaces. - The typedefs for our exposed but opaque types are visible in the header files and copied into consuming projects as forward declarations. We ultimately want to give SSL a destructor, but clobbering an unnamespaced ssl_st::~ssl_st seems bad manners. - MSVC complains about ambiguous names if one typedefs SSL to bssl::SSL. This CL opts for: - ssl/*.cc must begin with #define BORINGSSL_INTERNAL_CXX_TYPES. This informs the public headers to create forward declarations which are compatible with our namespaces. - For now, C++-defined type FOO ends up at bssl::FOO with a typedef outside. Later I imagine we'll rename many of them. - Internal functions get namespace bssl, so we stop worrying about stomping the tls1_prf symbol. Exported C functions are stuck as they are. Rather than try anything weird, bite the bullet and reorder files which have a mix of public and private functions. I expect that over time, the public functions will become fairly small as we move logic to more idiomatic C++. Files without any public C functions can just be written normally. - To avoid MSVC troubles, some bssl types are renamed to CPlusPlusStyle in advance of them being made idiomatic C++. Bug: 132 Change-Id: Ic931895e117c38b14ff8d6e5a273e868796c7581 Reviewed-on: https://boringssl-review.googlesource.com/18124 Reviewed-by: David Benjamin <davidben@google.com>
2017-07-18 21:34:25 +01:00
namespace bssl {
Reject empty records of unexpected type. The old empty record logic discarded the records at a very low-level. Let the error bubble up to ssl3_read_bytes so the type mismatch logic may kick in before the empty record is skipped. Add tests for when the record in question is application data, before before the handshake and post ChangeCipherSpec. BUG=521840 Change-Id: I47dff389cda65d6672b9be39d7d89490331063fa Reviewed-on: https://boringssl-review.googlesource.com/5754 Reviewed-by: Adam Langley <agl@google.com>
2015-08-22 06:35:43 +01:00
/* kMaxEmptyRecords is the number of consecutive, empty records that will be
* processed. Without this limit an attacker could send empty records at a
* faster rate than we can process and cause record processing to loop
* forever. */
static const uint8_t kMaxEmptyRecords = 32;
Enabling 0-RTT on new Session Tickets. This adds support for setting 0-RTT mode on tickets minted by BoringSSL, allowing for testing of the initial handshake knowledge. BUG=76 Change-Id: Ic199842c03b5401ef122a537fdb7ed9e9a5c635a Reviewed-on: https://boringssl-review.googlesource.com/12740 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-07 20:29:45 +00:00
/* kMaxEarlyDataSkipped is the maximum number of rejected early data bytes that
* will be skipped. Without this limit an attacker could send records at a
* faster rate than we can process and cause trial decryption to loop forever.
Enforce max_early_data_size on the server. BUG=76 Change-Id: I8b754ba17b3e0beee425929e4b53785b2e95f0ae Reviewed-on: https://boringssl-review.googlesource.com/15164 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-17 19:12:33 +01:00
* This value should be slightly above kMaxEarlyDataAccepted, which is measured
* in plaintext. */
Skipping early data on 0RTT rejection. BUG=101 Change-Id: Ia1edbccee535b0bc3a0e18465286d5bcca240035 Reviewed-on: https://boringssl-review.googlesource.com/12470 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-29 18:36:45 +00:00
static const size_t kMaxEarlyDataSkipped = 16384;
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
/* kMaxWarningAlerts is the number of consecutive warning alerts that will be
* processed. */
static const uint8_t kMaxWarningAlerts = 4;
Remove |need_record_splitting| from |SSL3_STATE|. It is redundant given the other state in the connection. Change-Id: I5dc71627132659ab4316a5ea360c9ca480fb7c6c Reviewed-on: https://boringssl-review.googlesource.com/6646 Reviewed-by: Adam Langley <agl@google.com>
2015-12-06 21:07:47 +00:00
/* ssl_needs_record_splitting returns one if |ssl|'s current outgoing cipher
* state needs record-splitting and zero otherwise. */
static int ssl_needs_record_splitting(const SSL *ssl) {
Disable record splitting in fuzzer mode. Record splitting is a send-side only behaviour and supporting it in fuzzer mode was messy. Change-Id: I406d2cc77f1d83ed2039a85b95acdfbc815f5a44 Reviewed-on: https://boringssl-review.googlesource.com/17944 Reviewed-by: Adam Langley <agl@google.com>
2017-07-15 00:51:39 +01:00
#if !defined(BORINGSSL_UNSAFE_FUZZER_MODE)
C++-ify SSL_AEAD_CTX. This adds several utilities as replacements for new and delete and makes bssl::UniquePtr work with our private types. Later work can convert more incrementally. I did this one more aggressively to see how it'd work. Unfortunately, in doing so, I needed to remove the NULL SSL_AEAD_CTX "method" receiver trick to appease clang. The null cipher is now represented by a concrete SSL_AEAD_CTX. The long-lived references to SSL_AEAD_CTX are not yet in types with constructors, so they still bare Delete rather than UniquePtr for now. Though this does mean we may be able to move the sequence number into SSLAEADContext later which is one less object for DTLS to carry around. Bug: 132 Change-Id: I506b404addafb692055d5709b0ca6d5439a4e6be Reviewed-on: https://boringssl-review.googlesource.com/18164 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2017-07-19 03:45:18 +01:00
return !ssl->s3->aead_write_ctx->is_null_cipher() &&
ssl->s3->aead_write_ctx->version() < TLS1_1_VERSION &&
Remove |need_record_splitting| from |SSL3_STATE|. It is redundant given the other state in the connection. Change-Id: I5dc71627132659ab4316a5ea360c9ca480fb7c6c Reviewed-on: https://boringssl-review.googlesource.com/6646 Reviewed-by: Adam Langley <agl@google.com>
2015-12-06 21:07:47 +00:00
(ssl->mode & SSL_MODE_CBC_RECORD_SPLITTING) != 0 &&
C++-ify SSL_AEAD_CTX. This adds several utilities as replacements for new and delete and makes bssl::UniquePtr work with our private types. Later work can convert more incrementally. I did this one more aggressively to see how it'd work. Unfortunately, in doing so, I needed to remove the NULL SSL_AEAD_CTX "method" receiver trick to appease clang. The null cipher is now represented by a concrete SSL_AEAD_CTX. The long-lived references to SSL_AEAD_CTX are not yet in types with constructors, so they still bare Delete rather than UniquePtr for now. Though this does mean we may be able to move the sequence number into SSLAEADContext later which is one less object for DTLS to carry around. Bug: 132 Change-Id: I506b404addafb692055d5709b0ca6d5439a4e6be Reviewed-on: https://boringssl-review.googlesource.com/18164 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2017-07-19 03:45:18 +01:00
SSL_CIPHER_is_block_cipher(ssl->s3->aead_write_ctx->cipher());
Disable record splitting in fuzzer mode. Record splitting is a send-side only behaviour and supporting it in fuzzer mode was messy. Change-Id: I406d2cc77f1d83ed2039a85b95acdfbc815f5a44 Reviewed-on: https://boringssl-review.googlesource.com/17944 Reviewed-by: Adam Langley <agl@google.com>
2017-07-15 00:51:39 +01:00
#else
return 0;
#endif
Remove |need_record_splitting| from |SSL3_STATE|. It is redundant given the other state in the connection. Change-Id: I5dc71627132659ab4316a5ea360c9ca480fb7c6c Reviewed-on: https://boringssl-review.googlesource.com/6646 Reviewed-by: Adam Langley <agl@google.com>
2015-12-06 21:07:47 +00:00
}
Move ssl3_record_sequence_update with the other record-layer bits. Change-Id: I045a4d3e304872b8c97231dcde5bca7753a878fb Reviewed-on: https://boringssl-review.googlesource.com/6831 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-12-25 20:11:39 +00:00
int ssl_record_sequence_update(uint8_t *seq, size_t seq_len) {
Use C99 for size_t loops. This was done just by grepping for 'size_t i;' and 'size_t j;'. I left everything in crypto/x509 and friends alone. There's some instances in gcm.c that are non-trivial and pulled into a separate CL for ease of review. Change-Id: I6515804e3097f7e90855f1e7610868ee87117223 Reviewed-on: https://boringssl-review.googlesource.com/10801 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-05 17:47:25 +01:00
for (size_t i = seq_len - 1; i < seq_len; i--) {
Move ssl3_record_sequence_update with the other record-layer bits. Change-Id: I045a4d3e304872b8c97231dcde5bca7753a878fb Reviewed-on: https://boringssl-review.googlesource.com/6831 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-12-25 20:11:39 +00:00
++seq[i];
if (seq[i] != 0) {
return 1;
}
}
OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW);
return 0;
}
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
size_t ssl_record_prefix_len(const SSL *ssl) {
Add experimental TLS 1.3 short record header extension. This extension will be used to test whether https://github.com/tlswg/tls13-spec/pull/762 is deployable against middleboxes. For simplicity, it is mutually exclusive with 0-RTT. If client and server agree on the extension, TLS 1.3 records will use the format in the PR rather than what is in draft 18. BUG=119 Change-Id: I1372ddf7b328ddf73d496df54ac03a95ede961e1 Reviewed-on: https://boringssl-review.googlesource.com/12684 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-21 21:06:54 +00:00
size_t header_len;
Add SSL_is_dtls. OpenSSL 1.1.0 added a function to tell if an SSL* is DTLS or not. This is probably a good idea, especially since SSL_version returns non-normalized versions. BUG=91 Change-Id: I25c6cf08b2ebabf0c610c74691de103399f729bc Reviewed-on: https://boringssl-review.googlesource.com/9077 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-02 21:22:34 +01:00
if (SSL_is_dtls(ssl)) {
Add experimental TLS 1.3 short record header extension. This extension will be used to test whether https://github.com/tlswg/tls13-spec/pull/762 is deployable against middleboxes. For simplicity, it is mutually exclusive with 0-RTT. If client and server agree on the extension, TLS 1.3 records will use the format in the PR rather than what is in draft 18. BUG=119 Change-Id: I1372ddf7b328ddf73d496df54ac03a95ede961e1 Reviewed-on: https://boringssl-review.googlesource.com/12684 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-21 21:06:54 +00:00
header_len = DTLS1_RT_HEADER_LENGTH;
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
} else {
Add experimental TLS 1.3 short record header extension. This extension will be used to test whether https://github.com/tlswg/tls13-spec/pull/762 is deployable against middleboxes. For simplicity, it is mutually exclusive with 0-RTT. If client and server agree on the extension, TLS 1.3 records will use the format in the PR rather than what is in draft 18. BUG=119 Change-Id: I1372ddf7b328ddf73d496df54ac03a95ede961e1 Reviewed-on: https://boringssl-review.googlesource.com/12684 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-21 21:06:54 +00:00
header_len = SSL3_RT_HEADER_LENGTH;
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
}
Add experimental TLS 1.3 short record header extension. This extension will be used to test whether https://github.com/tlswg/tls13-spec/pull/762 is deployable against middleboxes. For simplicity, it is mutually exclusive with 0-RTT. If client and server agree on the extension, TLS 1.3 records will use the format in the PR rather than what is in draft 18. BUG=119 Change-Id: I1372ddf7b328ddf73d496df54ac03a95ede961e1 Reviewed-on: https://boringssl-review.googlesource.com/12684 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-21 21:06:54 +00:00
C++-ify SSL_AEAD_CTX. This adds several utilities as replacements for new and delete and makes bssl::UniquePtr work with our private types. Later work can convert more incrementally. I did this one more aggressively to see how it'd work. Unfortunately, in doing so, I needed to remove the NULL SSL_AEAD_CTX "method" receiver trick to appease clang. The null cipher is now represented by a concrete SSL_AEAD_CTX. The long-lived references to SSL_AEAD_CTX are not yet in types with constructors, so they still bare Delete rather than UniquePtr for now. Though this does mean we may be able to move the sequence number into SSLAEADContext later which is one less object for DTLS to carry around. Bug: 132 Change-Id: I506b404addafb692055d5709b0ca6d5439a4e6be Reviewed-on: https://boringssl-review.googlesource.com/18164 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2017-07-19 03:45:18 +01:00
return header_len + ssl->s3->aead_read_ctx->ExplicitNonceLen();
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
}
Remove in-place TLS record assembly for now. Decrypting is very easy to do in-place, but encrypting in-place is a hassle. The rules actually were wrong due to record-splitting. The aliasing prefix and the alignment prefix actually differ by 1. Take it out for now in preparation for tightening the aliasing rules. If we decide to do in-place encrypt later, probably it'd be more useful to return header + in-place ciphertext + trailer. (That, in turn, needs a scatter/gather thing on the AEAD thanks to TLS 1.3's padding and record type construction.) We may also wish to rethink how record-splitting works here. Change-Id: I0187d39c541e76ef933b7c2c193323164fd8a156 Reviewed-on: https://boringssl-review.googlesource.com/8230 Reviewed-by: Adam Langley <agl@google.com>
2016-06-08 23:31:24 +01:00
size_t ssl_seal_align_prefix_len(const SSL *ssl) {
Add SSL_is_dtls. OpenSSL 1.1.0 added a function to tell if an SSL* is DTLS or not. This is probably a good idea, especially since SSL_version returns non-normalized versions. BUG=91 Change-Id: I25c6cf08b2ebabf0c610c74691de103399f729bc Reviewed-on: https://boringssl-review.googlesource.com/9077 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-02 21:22:34 +01:00
if (SSL_is_dtls(ssl)) {
C++-ify SSL_AEAD_CTX. This adds several utilities as replacements for new and delete and makes bssl::UniquePtr work with our private types. Later work can convert more incrementally. I did this one more aggressively to see how it'd work. Unfortunately, in doing so, I needed to remove the NULL SSL_AEAD_CTX "method" receiver trick to appease clang. The null cipher is now represented by a concrete SSL_AEAD_CTX. The long-lived references to SSL_AEAD_CTX are not yet in types with constructors, so they still bare Delete rather than UniquePtr for now. Though this does mean we may be able to move the sequence number into SSLAEADContext later which is one less object for DTLS to carry around. Bug: 132 Change-Id: I506b404addafb692055d5709b0ca6d5439a4e6be Reviewed-on: https://boringssl-review.googlesource.com/18164 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2017-07-19 03:45:18 +01:00
return DTLS1_RT_HEADER_LENGTH + ssl->s3->aead_write_ctx->ExplicitNonceLen();
Add experimental TLS 1.3 short record header extension. This extension will be used to test whether https://github.com/tlswg/tls13-spec/pull/762 is deployable against middleboxes. For simplicity, it is mutually exclusive with 0-RTT. If client and server agree on the extension, TLS 1.3 records will use the format in the PR rather than what is in draft 18. BUG=119 Change-Id: I1372ddf7b328ddf73d496df54ac03a95ede961e1 Reviewed-on: https://boringssl-review.googlesource.com/12684 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-21 21:06:54 +00:00
}
C++-ify SSL_AEAD_CTX. This adds several utilities as replacements for new and delete and makes bssl::UniquePtr work with our private types. Later work can convert more incrementally. I did this one more aggressively to see how it'd work. Unfortunately, in doing so, I needed to remove the NULL SSL_AEAD_CTX "method" receiver trick to appease clang. The null cipher is now represented by a concrete SSL_AEAD_CTX. The long-lived references to SSL_AEAD_CTX are not yet in types with constructors, so they still bare Delete rather than UniquePtr for now. Though this does mean we may be able to move the sequence number into SSLAEADContext later which is one less object for DTLS to carry around. Bug: 132 Change-Id: I506b404addafb692055d5709b0ca6d5439a4e6be Reviewed-on: https://boringssl-review.googlesource.com/18164 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2017-07-19 03:45:18 +01:00
size_t ret =
SSL3_RT_HEADER_LENGTH + ssl->s3->aead_write_ctx->ExplicitNonceLen();
Add experimental TLS 1.3 short record header extension. This extension will be used to test whether https://github.com/tlswg/tls13-spec/pull/762 is deployable against middleboxes. For simplicity, it is mutually exclusive with 0-RTT. If client and server agree on the extension, TLS 1.3 records will use the format in the PR rather than what is in draft 18. BUG=119 Change-Id: I1372ddf7b328ddf73d496df54ac03a95ede961e1 Reviewed-on: https://boringssl-review.googlesource.com/12684 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-21 21:06:54 +00:00
if (ssl_needs_record_splitting(ssl)) {
Remove experimental TLS 1.3 short record header extension. Due to middlebox and ecosystem intolerance, short record headers are going to be unsustainable to deploy. BUG=119 Change-Id: I20fee79dd85bff229eafc6aeb72e4f33cac96d82 Reviewed-on: https://boringssl-review.googlesource.com/14044 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-02 21:05:03 +00:00
ret += SSL3_RT_HEADER_LENGTH;
C++-ify SSL_AEAD_CTX. This adds several utilities as replacements for new and delete and makes bssl::UniquePtr work with our private types. Later work can convert more incrementally. I did this one more aggressively to see how it'd work. Unfortunately, in doing so, I needed to remove the NULL SSL_AEAD_CTX "method" receiver trick to appease clang. The null cipher is now represented by a concrete SSL_AEAD_CTX. The long-lived references to SSL_AEAD_CTX are not yet in types with constructors, so they still bare Delete rather than UniquePtr for now. Though this does mean we may be able to move the sequence number into SSLAEADContext later which is one less object for DTLS to carry around. Bug: 132 Change-Id: I506b404addafb692055d5709b0ca6d5439a4e6be Reviewed-on: https://boringssl-review.googlesource.com/18164 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2017-07-19 03:45:18 +01:00
ret += ssl_cipher_get_record_split_len(ssl->s3->aead_write_ctx->cipher());
Add experimental TLS 1.3 short record header extension. This extension will be used to test whether https://github.com/tlswg/tls13-spec/pull/762 is deployable against middleboxes. For simplicity, it is mutually exclusive with 0-RTT. If client and server agree on the extension, TLS 1.3 records will use the format in the PR rather than what is in draft 18. BUG=119 Change-Id: I1372ddf7b328ddf73d496df54ac03a95ede961e1 Reviewed-on: https://boringssl-review.googlesource.com/12684 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-21 21:06:54 +00:00
}
return ret;
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
}
Make tls_open_record always in-place. The business with ssl_record_prefix_len is rather a hassle. Instead, have tls_open_record always decrypt in-place and give back a CBS to where the body is. This way the caller doesn't need to do an extra check all to avoid creating an invalid pointer and underflow in subtraction. Change-Id: I4e12b25a760870d8f8a503673ab00a2d774fc9ee Reviewed-on: https://boringssl-review.googlesource.com/8173 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-06 23:54:51 +01:00
enum ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type, CBS *out,
size_t *out_consumed, uint8_t *out_alert,
uint8_t *in, size_t in_len) {
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
*out_consumed = 0;
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
CBS cbs;
CBS_init(&cbs, in, in_len);
/* Decode the record header. */
uint8_t type;
uint16_t version, ciphertext_len;
Remove experimental TLS 1.3 short record header extension. Due to middlebox and ecosystem intolerance, short record headers are going to be unsustainable to deploy. BUG=119 Change-Id: I20fee79dd85bff229eafc6aeb72e4f33cac96d82 Reviewed-on: https://boringssl-review.googlesource.com/14044 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-02 21:05:03 +00:00
if (!CBS_get_u8(&cbs, &type) ||
!CBS_get_u16(&cbs, &version) ||
!CBS_get_u16(&cbs, &ciphertext_len)) {
*out_consumed = SSL3_RT_HEADER_LENGTH;
return ssl_open_record_partial;
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
}
Enforce record-layer version numbers. We used to enforce after the version was set, but stopped enforcing with TLS 1.3. NSS enforces the value for encrypted records, which makes sense and avoids the problems gating it on have_version. Add tests for this. Change-Id: I7fb5f94ab4a22e8e3b1c14205aa934952d671727 Reviewed-on: https://boringssl-review.googlesource.com/12143 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-08 19:28:24 +00:00
int version_ok;
C++-ify SSL_AEAD_CTX. This adds several utilities as replacements for new and delete and makes bssl::UniquePtr work with our private types. Later work can convert more incrementally. I did this one more aggressively to see how it'd work. Unfortunately, in doing so, I needed to remove the NULL SSL_AEAD_CTX "method" receiver trick to appease clang. The null cipher is now represented by a concrete SSL_AEAD_CTX. The long-lived references to SSL_AEAD_CTX are not yet in types with constructors, so they still bare Delete rather than UniquePtr for now. Though this does mean we may be able to move the sequence number into SSLAEADContext later which is one less object for DTLS to carry around. Bug: 132 Change-Id: I506b404addafb692055d5709b0ca6d5439a4e6be Reviewed-on: https://boringssl-review.googlesource.com/18164 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2017-07-19 03:45:18 +01:00
if (ssl->s3->aead_read_ctx->is_null_cipher()) {
Enforce record-layer version numbers. We used to enforce after the version was set, but stopped enforcing with TLS 1.3. NSS enforces the value for encrypted records, which makes sense and avoids the problems gating it on have_version. Add tests for this. Change-Id: I7fb5f94ab4a22e8e3b1c14205aa934952d671727 Reviewed-on: https://boringssl-review.googlesource.com/12143 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-08 19:28:24 +00:00
/* Only check the first byte. Enforcing beyond that can prevent decoding
* version negotiation failure alerts. */
version_ok = (version >> 8) == SSL3_VERSION_MAJOR;
} else if (ssl3_protocol_version(ssl) < TLS1_3_VERSION) {
/* Earlier versions of TLS switch the record version. */
version_ok = version == ssl->version;
} else {
/* Starting TLS 1.3, the version field is frozen at {3, 1}. */
version_ok = version == TLS1_VERSION;
}
if (!version_ok) {
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_VERSION_NUMBER);
*out_alert = SSL_AD_PROTOCOL_VERSION;
return ssl_open_record_error;
}
/* Check the ciphertext length. */
Remove SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER. This dates to SSLeay 0.8.0 (or earlier). The use counter sees virtually no hits. Change-Id: Iff4c8899d5cb0ba4afca113c66d15f1d980ffe41 Reviewed-on: https://boringssl-review.googlesource.com/6558 Reviewed-by: Adam Langley <agl@google.com>
2015-11-19 01:41:11 +00:00
if (ciphertext_len > SSL3_RT_MAX_ENCRYPTED_LENGTH) {
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
OPENSSL_PUT_ERROR(SSL, SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
*out_alert = SSL_AD_RECORD_OVERFLOW;
return ssl_open_record_error;
}
/* Extract the body. */
CBS body;
if (!CBS_get_bytes(&cbs, &body, ciphertext_len)) {
Remove experimental TLS 1.3 short record header extension. Due to middlebox and ecosystem intolerance, short record headers are going to be unsustainable to deploy. BUG=119 Change-Id: I20fee79dd85bff229eafc6aeb72e4f33cac96d82 Reviewed-on: https://boringssl-review.googlesource.com/14044 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-02 21:05:03 +00:00
*out_consumed = SSL3_RT_HEADER_LENGTH + (size_t)ciphertext_len;
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
return ssl_open_record_partial;
}
Remove experimental TLS 1.3 short record header extension. Due to middlebox and ecosystem intolerance, short record headers are going to be unsustainable to deploy. BUG=119 Change-Id: I20fee79dd85bff229eafc6aeb72e4f33cac96d82 Reviewed-on: https://boringssl-review.googlesource.com/14044 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-02 21:05:03 +00:00
ssl_do_msg_callback(ssl, 0 /* read */, SSL3_RT_HEADER, in,
SSL3_RT_HEADER_LENGTH);
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
Skipping early data on 0RTT rejection. BUG=101 Change-Id: Ia1edbccee535b0bc3a0e18465286d5bcca240035 Reviewed-on: https://boringssl-review.googlesource.com/12470 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-29 18:36:45 +00:00
*out_consumed = in_len - CBS_len(&cbs);
/* Skip early data received when expecting a second ClientHello if we rejected
* 0RTT. */
if (ssl->s3->skip_early_data &&
C++-ify SSL_AEAD_CTX. This adds several utilities as replacements for new and delete and makes bssl::UniquePtr work with our private types. Later work can convert more incrementally. I did this one more aggressively to see how it'd work. Unfortunately, in doing so, I needed to remove the NULL SSL_AEAD_CTX "method" receiver trick to appease clang. The null cipher is now represented by a concrete SSL_AEAD_CTX. The long-lived references to SSL_AEAD_CTX are not yet in types with constructors, so they still bare Delete rather than UniquePtr for now. Though this does mean we may be able to move the sequence number into SSLAEADContext later which is one less object for DTLS to carry around. Bug: 132 Change-Id: I506b404addafb692055d5709b0ca6d5439a4e6be Reviewed-on: https://boringssl-review.googlesource.com/18164 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2017-07-19 03:45:18 +01:00
ssl->s3->aead_read_ctx->is_null_cipher() &&
Skipping early data on 0RTT rejection. BUG=101 Change-Id: Ia1edbccee535b0bc3a0e18465286d5bcca240035 Reviewed-on: https://boringssl-review.googlesource.com/12470 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-29 18:36:45 +00:00
type == SSL3_RT_APPLICATION_DATA) {
goto skipped_data;
}
Make tls_open_record always in-place. The business with ssl_record_prefix_len is rather a hassle. Instead, have tls_open_record always decrypt in-place and give back a CBS to where the body is. This way the caller doesn't need to do an extra check all to avoid creating an invalid pointer and underflow in subtraction. Change-Id: I4e12b25a760870d8f8a503673ab00a2d774fc9ee Reviewed-on: https://boringssl-review.googlesource.com/8173 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-06 23:54:51 +01:00
/* Decrypt the body in-place. */
C++-ify SSL_AEAD_CTX. This adds several utilities as replacements for new and delete and makes bssl::UniquePtr work with our private types. Later work can convert more incrementally. I did this one more aggressively to see how it'd work. Unfortunately, in doing so, I needed to remove the NULL SSL_AEAD_CTX "method" receiver trick to appease clang. The null cipher is now represented by a concrete SSL_AEAD_CTX. The long-lived references to SSL_AEAD_CTX are not yet in types with constructors, so they still bare Delete rather than UniquePtr for now. Though this does mean we may be able to move the sequence number into SSLAEADContext later which is one less object for DTLS to carry around. Bug: 132 Change-Id: I506b404addafb692055d5709b0ca6d5439a4e6be Reviewed-on: https://boringssl-review.googlesource.com/18164 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2017-07-19 03:45:18 +01:00
if (!ssl->s3->aead_read_ctx->Open(out, type, version, ssl->s3->read_sequence,
(uint8_t *)CBS_data(&body),
CBS_len(&body))) {
if (ssl->s3->skip_early_data && !ssl->s3->aead_read_ctx->is_null_cipher()) {
Skipping early data on 0RTT rejection. BUG=101 Change-Id: Ia1edbccee535b0bc3a0e18465286d5bcca240035 Reviewed-on: https://boringssl-review.googlesource.com/12470 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-29 18:36:45 +00:00
ERR_clear_error();
goto skipped_data;
}
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
OPENSSL_PUT_ERROR(SSL, SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
*out_alert = SSL_AD_BAD_RECORD_MAC;
return ssl_open_record_error;
}
Skipping early data on 0RTT rejection. BUG=101 Change-Id: Ia1edbccee535b0bc3a0e18465286d5bcca240035 Reviewed-on: https://boringssl-review.googlesource.com/12470 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-29 18:36:45 +00:00
ssl->s3->skip_early_data = 0;
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
Move ssl3_record_sequence_update with the other record-layer bits. Change-Id: I045a4d3e304872b8c97231dcde5bca7753a878fb Reviewed-on: https://boringssl-review.googlesource.com/6831 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-12-25 20:11:39 +00:00
if (!ssl_record_sequence_update(ssl->s3->read_sequence, 8)) {
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
*out_alert = SSL_AD_INTERNAL_ERROR;
return ssl_open_record_error;
}
Adding TLS 1.3 Record Layer. In TLS 1.3, the actual record type is hidden within the encrypted data and the record layer defaults to using a TLS 1.0 {3, 1} record version for compatibility. Additionally the record layer no longer checks the minor version of the record layer to maintain compatibility with the TLS 1.3 spec. Change-Id: If2c08e48baab170c1658e0715c33929d36c9be3a Reviewed-on: https://boringssl-review.googlesource.com/8091 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-01 19:07:09 +01:00
/* TLS 1.3 hides the record type inside the encrypted data. */
C++-ify SSL_AEAD_CTX. This adds several utilities as replacements for new and delete and makes bssl::UniquePtr work with our private types. Later work can convert more incrementally. I did this one more aggressively to see how it'd work. Unfortunately, in doing so, I needed to remove the NULL SSL_AEAD_CTX "method" receiver trick to appease clang. The null cipher is now represented by a concrete SSL_AEAD_CTX. The long-lived references to SSL_AEAD_CTX are not yet in types with constructors, so they still bare Delete rather than UniquePtr for now. Though this does mean we may be able to move the sequence number into SSLAEADContext later which is one less object for DTLS to carry around. Bug: 132 Change-Id: I506b404addafb692055d5709b0ca6d5439a4e6be Reviewed-on: https://boringssl-review.googlesource.com/18164 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2017-07-19 03:45:18 +01:00
if (!ssl->s3->aead_read_ctx->is_null_cipher() &&
ssl->s3->aead_read_ctx->version() >= TLS1_3_VERSION) {
Build up TLS 1.3 record-layer tests. This also adds a missing check to the C half to ensure fake record types are always correct, to keep implementations honest. Change-Id: I1d65272e647ffa67018c721d52c639f8ba47d647 Reviewed-on: https://boringssl-review.googlesource.com/8510 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-25 03:56:37 +01:00
/* The outer record type is always application_data. */
if (type != SSL3_RT_APPLICATION_DATA) {
OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_OUTER_RECORD_TYPE);
*out_alert = SSL_AD_DECODE_ERROR;
return ssl_open_record_error;
}
Make tls_open_record always in-place. The business with ssl_record_prefix_len is rather a hassle. Instead, have tls_open_record always decrypt in-place and give back a CBS to where the body is. This way the caller doesn't need to do an extra check all to avoid creating an invalid pointer and underflow in subtraction. Change-Id: I4e12b25a760870d8f8a503673ab00a2d774fc9ee Reviewed-on: https://boringssl-review.googlesource.com/8173 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-06 23:54:51 +01:00
do {
if (!CBS_get_last_u8(out, &type)) {
OPENSSL_PUT_ERROR(SSL, SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
*out_alert = SSL_AD_DECRYPT_ERROR;
return ssl_open_record_error;
}
} while (type == 0);
Adding TLS 1.3 Record Layer. In TLS 1.3, the actual record type is hidden within the encrypted data and the record layer defaults to using a TLS 1.0 {3, 1} record version for compatibility. Additionally the record layer no longer checks the minor version of the record layer to maintain compatibility with the TLS 1.3 spec. Change-Id: If2c08e48baab170c1658e0715c33929d36c9be3a Reviewed-on: https://boringssl-review.googlesource.com/8091 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-01 19:07:09 +01:00
}
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
/* Check the plaintext length. */
Make tls_open_record always in-place. The business with ssl_record_prefix_len is rather a hassle. Instead, have tls_open_record always decrypt in-place and give back a CBS to where the body is. This way the caller doesn't need to do an extra check all to avoid creating an invalid pointer and underflow in subtraction. Change-Id: I4e12b25a760870d8f8a503673ab00a2d774fc9ee Reviewed-on: https://boringssl-review.googlesource.com/8173 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-06 23:54:51 +01:00
if (CBS_len(out) > SSL3_RT_MAX_PLAIN_LENGTH) {
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
OPENSSL_PUT_ERROR(SSL, SSL_R_DATA_LENGTH_TOO_LONG);
*out_alert = SSL_AD_RECORD_OVERFLOW;
return ssl_open_record_error;
}
Reject empty records of unexpected type. The old empty record logic discarded the records at a very low-level. Let the error bubble up to ssl3_read_bytes so the type mismatch logic may kick in before the empty record is skipped. Add tests for when the record in question is application data, before before the handshake and post ChangeCipherSpec. BUG=521840 Change-Id: I47dff389cda65d6672b9be39d7d89490331063fa Reviewed-on: https://boringssl-review.googlesource.com/5754 Reviewed-by: Adam Langley <agl@google.com>
2015-08-22 06:35:43 +01:00
/* Limit the number of consecutive empty records. */
Make tls_open_record always in-place. The business with ssl_record_prefix_len is rather a hassle. Instead, have tls_open_record always decrypt in-place and give back a CBS to where the body is. This way the caller doesn't need to do an extra check all to avoid creating an invalid pointer and underflow in subtraction. Change-Id: I4e12b25a760870d8f8a503673ab00a2d774fc9ee Reviewed-on: https://boringssl-review.googlesource.com/8173 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-06 23:54:51 +01:00
if (CBS_len(out) == 0) {
Reject empty records of unexpected type. The old empty record logic discarded the records at a very low-level. Let the error bubble up to ssl3_read_bytes so the type mismatch logic may kick in before the empty record is skipped. Add tests for when the record in question is application data, before before the handshake and post ChangeCipherSpec. BUG=521840 Change-Id: I47dff389cda65d6672b9be39d7d89490331063fa Reviewed-on: https://boringssl-review.googlesource.com/5754 Reviewed-by: Adam Langley <agl@google.com>
2015-08-22 06:35:43 +01:00
ssl->s3->empty_record_count++;
if (ssl->s3->empty_record_count > kMaxEmptyRecords) {
OPENSSL_PUT_ERROR(SSL, SSL_R_TOO_MANY_EMPTY_FRAGMENTS);
*out_alert = SSL_AD_UNEXPECTED_MESSAGE;
return ssl_open_record_error;
}
/* Apart from the limit, empty records are returned up to the caller. This
* allows the caller to reject records of the wrong type. */
} else {
ssl->s3->empty_record_count = 0;
}
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
if (type == SSL3_RT_ALERT) {
Add Data-less Zero-RTT support. This adds support on the server and client to accept data-less early data. The server will still fail to parse early data with any contents, so this should remain disabled. BUG=76 Change-Id: Id85d192d8e0360b8de4b6971511b5e8a0e8012f7 Reviewed-on: https://boringssl-review.googlesource.com/12921 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-01-11 16:34:52 +00:00
/* Return end_of_early_data alerts as-is for the caller to process. */
if (CBS_len(out) == 2 &&
CBS_data(out)[0] == SSL3_AL_WARNING &&
CBS_data(out)[1] == TLS1_AD_END_OF_EARLY_DATA) {
*out_type = type;
return ssl_open_record_success;
}
Make tls_open_record always in-place. The business with ssl_record_prefix_len is rather a hassle. Instead, have tls_open_record always decrypt in-place and give back a CBS to where the body is. This way the caller doesn't need to do an extra check all to avoid creating an invalid pointer and underflow in subtraction. Change-Id: I4e12b25a760870d8f8a503673ab00a2d774fc9ee Reviewed-on: https://boringssl-review.googlesource.com/8173 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-06 23:54:51 +01:00
return ssl_process_alert(ssl, out_alert, CBS_data(out), CBS_len(out));
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
}
ssl->s3->warning_alert_count = 0;
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
*out_type = type;
return ssl_open_record_success;
Skipping early data on 0RTT rejection. BUG=101 Change-Id: Ia1edbccee535b0bc3a0e18465286d5bcca240035 Reviewed-on: https://boringssl-review.googlesource.com/12470 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-11-29 18:36:45 +00:00
skipped_data:
ssl->s3->early_data_skipped += *out_consumed;
if (ssl->s3->early_data_skipped < *out_consumed) {
ssl->s3->early_data_skipped = kMaxEarlyDataSkipped + 1;
}
if (ssl->s3->early_data_skipped > kMaxEarlyDataSkipped) {
OPENSSL_PUT_ERROR(SSL, SSL_R_TOO_MUCH_SKIPPED_EARLY_DATA);
*out_alert = SSL_AD_UNEXPECTED_MESSAGE;
return ssl_open_record_error;
}
return ssl_open_record_discard;
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
}
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
static int do_seal_record(SSL *ssl, uint8_t *out_prefix, uint8_t *out,
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
uint8_t *out_suffix, uint8_t type, const uint8_t *in,
const size_t in_len) {
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
uint8_t *extra_in = NULL;
size_t extra_in_len = 0;
C++-ify SSL_AEAD_CTX. This adds several utilities as replacements for new and delete and makes bssl::UniquePtr work with our private types. Later work can convert more incrementally. I did this one more aggressively to see how it'd work. Unfortunately, in doing so, I needed to remove the NULL SSL_AEAD_CTX "method" receiver trick to appease clang. The null cipher is now represented by a concrete SSL_AEAD_CTX. The long-lived references to SSL_AEAD_CTX are not yet in types with constructors, so they still bare Delete rather than UniquePtr for now. Though this does mean we may be able to move the sequence number into SSLAEADContext later which is one less object for DTLS to carry around. Bug: 132 Change-Id: I506b404addafb692055d5709b0ca6d5439a4e6be Reviewed-on: https://boringssl-review.googlesource.com/18164 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2017-07-19 03:45:18 +01:00
if (!ssl->s3->aead_write_ctx->is_null_cipher() &&
ssl->s3->aead_write_ctx->version() >= TLS1_3_VERSION) {
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
/* TLS 1.3 hides the actual record type inside the encrypted data. */
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
extra_in = &type;
extra_in_len = 1;
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
}
size_t suffix_len;
if (!ssl->s3->aead_write_ctx->SuffixLen(&suffix_len, in_len, extra_in_len)) {
OPENSSL_PUT_ERROR(SSL, SSL_R_RECORD_TOO_LARGE);
return 0;
}
size_t ciphertext_len =
ssl->s3->aead_write_ctx->ExplicitNonceLen() + suffix_len;
if (ciphertext_len + in_len < ciphertext_len) {
OPENSSL_PUT_ERROR(SSL, SSL_R_RECORD_TOO_LARGE);
return 0;
}
ciphertext_len += in_len;
assert(in == out || !buffers_alias(in, in_len, out, in_len));
assert(!buffers_alias(in, in_len, out_prefix, ssl_record_prefix_len(ssl)));
assert(!buffers_alias(in, in_len, out_suffix, suffix_len));
if (extra_in_len) {
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
out_prefix[0] = SSL3_RT_APPLICATION_DATA;
} else {
out_prefix[0] = type;
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
}
Remove in-place TLS record assembly for now. Decrypting is very easy to do in-place, but encrypting in-place is a hassle. The rules actually were wrong due to record-splitting. The aliasing prefix and the alignment prefix actually differ by 1. Take it out for now in preparation for tightening the aliasing rules. If we decide to do in-place encrypt later, probably it'd be more useful to return header + in-place ciphertext + trailer. (That, in turn, needs a scatter/gather thing on the AEAD thanks to TLS 1.3's padding and record type construction.) We may also wish to rethink how record-splitting works here. Change-Id: I0187d39c541e76ef933b7c2c193323164fd8a156 Reviewed-on: https://boringssl-review.googlesource.com/8230 Reviewed-by: Adam Langley <agl@google.com>
2016-06-08 23:31:24 +01:00
Adding TLS 1.3 Record Layer. In TLS 1.3, the actual record type is hidden within the encrypted data and the record layer defaults to using a TLS 1.0 {3, 1} record version for compatibility. Additionally the record layer no longer checks the minor version of the record layer to maintain compatibility with the TLS 1.3 spec. Change-Id: If2c08e48baab170c1658e0715c33929d36c9be3a Reviewed-on: https://boringssl-review.googlesource.com/8091 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-01 19:07:09 +01:00
/* The TLS record-layer version number is meaningless and, starting in
* TLS 1.3, is frozen at TLS 1.0. But for historical reasons, SSL 3.0
* ClientHellos should use SSL 3.0 and pre-TLS-1.3 expects the version
* to change after version negotiation. */
uint16_t wire_version = TLS1_VERSION;
Revise version negotiation logic on the C side. This is in preparation for upcoming experiments which will require supporting multiple experimental versions of TLS 1.3 with, on the server, the ability to enable multiple variants at once. This means the version <-> wire bijection no longer exists, even when limiting to a single SSL*. Thus version_to_wire is removed and instead we treat the wire version as the canonical version value. There is a mapping from valid wire versions to protocol versions which describe the high-level handshake protocol in use. This mapping is not injective, so uses of version_from_wire are rewritten differently. All the version-munging logic is moved to ssl_versions.c with a master preference list of all TLS and DTLS versions. The legacy version negotiation is converted to the new scheme. The version lists and negotiation are driven by the preference lists and a ssl_supports_version API. To simplify the mess around SSL_SESSION and versions, version_from_wire is now DTLS/TLS-agnostic, with any filtering being done by ssl_supports_version. This is screwy but allows parsing SSL_SESSIONs to sanity-check it and reject all bogus versions in SSL_SESSION. This reduces a mess of error cases. As part of this, the weird logic where ssl->version is set early when sending the ClientHello is removed. The one place where we were relying on this behavior is tweaked to query hs->max_version instead. Change-Id: Ic91b348481ceba94d9ae06d6781187c11adc15b0 Reviewed-on: https://boringssl-review.googlesource.com/17524 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2017-06-20 15:55:02 +01:00
if (ssl->s3->hs != NULL && ssl->s3->hs->max_version == SSL3_VERSION) {
wire_version = SSL3_VERSION;
}
if (ssl->s3->have_version && ssl3_protocol_version(ssl) < TLS1_3_VERSION) {
Adding TLS 1.3 Record Layer. In TLS 1.3, the actual record type is hidden within the encrypted data and the record layer defaults to using a TLS 1.0 {3, 1} record version for compatibility. Additionally the record layer no longer checks the minor version of the record layer to maintain compatibility with the TLS 1.3 spec. Change-Id: If2c08e48baab170c1658e0715c33929d36c9be3a Reviewed-on: https://boringssl-review.googlesource.com/8091 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-01 19:07:09 +01:00
wire_version = ssl->version;
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
}
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
out_prefix[1] = wire_version >> 8;
out_prefix[2] = wire_version & 0xff;
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
out_prefix[3] = ciphertext_len >> 8;
out_prefix[4] = ciphertext_len & 0xff;
Add experimental TLS 1.3 short record header extension. This extension will be used to test whether https://github.com/tlswg/tls13-spec/pull/762 is deployable against middleboxes. For simplicity, it is mutually exclusive with 0-RTT. If client and server agree on the extension, TLS 1.3 records will use the format in the PR rather than what is in draft 18. BUG=119 Change-Id: I1372ddf7b328ddf73d496df54ac03a95ede961e1 Reviewed-on: https://boringssl-review.googlesource.com/12684 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-21 21:06:54 +00:00
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
if (!ssl->s3->aead_write_ctx->SealScatter(out_prefix + SSL3_RT_HEADER_LENGTH,
out, out_suffix, type, wire_version,
ssl->s3->write_sequence, in, in_len,
extra_in, extra_in_len) ||
Move ssl3_record_sequence_update with the other record-layer bits. Change-Id: I045a4d3e304872b8c97231dcde5bca7753a878fb Reviewed-on: https://boringssl-review.googlesource.com/6831 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-12-25 20:11:39 +00:00
!ssl_record_sequence_update(ssl->s3->write_sequence, 8)) {
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
return 0;
}
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
ssl_do_msg_callback(ssl, 1 /* write */, SSL3_RT_HEADER, out_prefix,
Remove experimental TLS 1.3 short record header extension. Due to middlebox and ecosystem intolerance, short record headers are going to be unsustainable to deploy. BUG=119 Change-Id: I20fee79dd85bff229eafc6aeb72e4f33cac96d82 Reviewed-on: https://boringssl-review.googlesource.com/14044 Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: Steven Valdez <svaldez@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-03-02 21:05:03 +00:00
SSL3_RT_HEADER_LENGTH);
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
return 1;
}
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
static size_t tls_seal_scatter_prefix_len(const SSL *ssl, uint8_t type,
Add bssl::SealRecord and bssl::OpenRecord. This is a C++ interface for encrypting and decrypting TLS application data records in-place, wrapping the existing C API in tls_record.cc. Also add bssl::Span, a non-owning reference to a contiguous array of elements which can be used as a common interface over contiguous container types (like std::vector), pointer-length-pairs, arrays, etc. Change-Id: Iaa2ca4957cde511cb734b997db38f54e103b0d92 Reviewed-on: https://boringssl-review.googlesource.com/18104 Commit-Queue: Martin Kreichgauer <martinkr@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-07-18 20:42:18 +01:00
size_t in_len) {
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
size_t ret = SSL3_RT_HEADER_LENGTH;
if (type == SSL3_RT_APPLICATION_DATA && in_len > 1 &&
ssl_needs_record_splitting(ssl)) {
/* In the case of record splitting, the 1-byte record (of the 1/n-1 split)
* will be placed in the prefix, as will four of the five bytes of the
* record header for the main record. The final byte will replace the first
* byte of the plaintext that was used in the small record. */
C++-ify SSL_AEAD_CTX. This adds several utilities as replacements for new and delete and makes bssl::UniquePtr work with our private types. Later work can convert more incrementally. I did this one more aggressively to see how it'd work. Unfortunately, in doing so, I needed to remove the NULL SSL_AEAD_CTX "method" receiver trick to appease clang. The null cipher is now represented by a concrete SSL_AEAD_CTX. The long-lived references to SSL_AEAD_CTX are not yet in types with constructors, so they still bare Delete rather than UniquePtr for now. Though this does mean we may be able to move the sequence number into SSLAEADContext later which is one less object for DTLS to carry around. Bug: 132 Change-Id: I506b404addafb692055d5709b0ca6d5439a4e6be Reviewed-on: https://boringssl-review.googlesource.com/18164 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2017-07-19 03:45:18 +01:00
ret += ssl_cipher_get_record_split_len(ssl->s3->aead_write_ctx->cipher());
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
ret += SSL3_RT_HEADER_LENGTH - 1;
} else {
C++-ify SSL_AEAD_CTX. This adds several utilities as replacements for new and delete and makes bssl::UniquePtr work with our private types. Later work can convert more incrementally. I did this one more aggressively to see how it'd work. Unfortunately, in doing so, I needed to remove the NULL SSL_AEAD_CTX "method" receiver trick to appease clang. The null cipher is now represented by a concrete SSL_AEAD_CTX. The long-lived references to SSL_AEAD_CTX are not yet in types with constructors, so they still bare Delete rather than UniquePtr for now. Though this does mean we may be able to move the sequence number into SSLAEADContext later which is one less object for DTLS to carry around. Bug: 132 Change-Id: I506b404addafb692055d5709b0ca6d5439a4e6be Reviewed-on: https://boringssl-review.googlesource.com/18164 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2017-07-19 03:45:18 +01:00
ret += ssl->s3->aead_write_ctx->ExplicitNonceLen();
Remove in-place TLS record assembly for now. Decrypting is very easy to do in-place, but encrypting in-place is a hassle. The rules actually were wrong due to record-splitting. The aliasing prefix and the alignment prefix actually differ by 1. Take it out for now in preparation for tightening the aliasing rules. If we decide to do in-place encrypt later, probably it'd be more useful to return header + in-place ciphertext + trailer. (That, in turn, needs a scatter/gather thing on the AEAD thanks to TLS 1.3's padding and record type construction.) We may also wish to rethink how record-splitting works here. Change-Id: I0187d39c541e76ef933b7c2c193323164fd8a156 Reviewed-on: https://boringssl-review.googlesource.com/8230 Reviewed-by: Adam Langley <agl@google.com>
2016-06-08 23:31:24 +01:00
}
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
return ret;
}
Remove in-place TLS record assembly for now. Decrypting is very easy to do in-place, but encrypting in-place is a hassle. The rules actually were wrong due to record-splitting. The aliasing prefix and the alignment prefix actually differ by 1. Take it out for now in preparation for tightening the aliasing rules. If we decide to do in-place encrypt later, probably it'd be more useful to return header + in-place ciphertext + trailer. (That, in turn, needs a scatter/gather thing on the AEAD thanks to TLS 1.3's padding and record type construction.) We may also wish to rethink how record-splitting works here. Change-Id: I0187d39c541e76ef933b7c2c193323164fd8a156 Reviewed-on: https://boringssl-review.googlesource.com/8230 Reviewed-by: Adam Langley <agl@google.com>
2016-06-08 23:31:24 +01:00
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
static bool tls_seal_scatter_suffix_len(const SSL *ssl, size_t *out_suffix_len,
uint8_t type, size_t in_len) {
size_t extra_in_len = 0;
if (!ssl->s3->aead_write_ctx->is_null_cipher() &&
Add bssl::SealRecord and bssl::OpenRecord. This is a C++ interface for encrypting and decrypting TLS application data records in-place, wrapping the existing C API in tls_record.cc. Also add bssl::Span, a non-owning reference to a contiguous array of elements which can be used as a common interface over contiguous container types (like std::vector), pointer-length-pairs, arrays, etc. Change-Id: Iaa2ca4957cde511cb734b997db38f54e103b0d92 Reviewed-on: https://boringssl-review.googlesource.com/18104 Commit-Queue: Martin Kreichgauer <martinkr@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-07-18 20:42:18 +01:00
ssl->s3->aead_write_ctx->version() >= TLS1_3_VERSION) {
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
/* TLS 1.3 adds an extra byte for encrypted record type. */
extra_in_len = 1;
Add bssl::SealRecord and bssl::OpenRecord. This is a C++ interface for encrypting and decrypting TLS application data records in-place, wrapping the existing C API in tls_record.cc. Also add bssl::Span, a non-owning reference to a contiguous array of elements which can be used as a common interface over contiguous container types (like std::vector), pointer-length-pairs, arrays, etc. Change-Id: Iaa2ca4957cde511cb734b997db38f54e103b0d92 Reviewed-on: https://boringssl-review.googlesource.com/18104 Commit-Queue: Martin Kreichgauer <martinkr@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-07-18 20:42:18 +01:00
}
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
if (type == SSL3_RT_APPLICATION_DATA && // clang-format off
in_len > 1 &&
ssl_needs_record_splitting(ssl)) {
/* With record splitting enabled, the first byte gets sealed into a separate
* record which is written into the prefix. */
in_len -= 1;
}
return ssl->s3->aead_write_ctx->SuffixLen(out_suffix_len, in_len, extra_in_len);
Add bssl::SealRecord and bssl::OpenRecord. This is a C++ interface for encrypting and decrypting TLS application data records in-place, wrapping the existing C API in tls_record.cc. Also add bssl::Span, a non-owning reference to a contiguous array of elements which can be used as a common interface over contiguous container types (like std::vector), pointer-length-pairs, arrays, etc. Change-Id: Iaa2ca4957cde511cb734b997db38f54e103b0d92 Reviewed-on: https://boringssl-review.googlesource.com/18104 Commit-Queue: Martin Kreichgauer <martinkr@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-07-18 20:42:18 +01:00
}
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
/* tls_seal_scatter_record seals a new record of type |type| and body |in| and
* splits it between |out_prefix|, |out|, and |out_suffix|. Exactly
* |tls_seal_scatter_prefix_len| bytes are written to |out_prefix|, |in_len|
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
* bytes to |out|, and |tls_seal_scatter_suffix_len| bytes to |out_suffix|. It
* returns one on success and zero on error. If enabled,
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
* |tls_seal_scatter_record| implements TLS 1.0 CBC 1/n-1 record splitting and
* may write two records concatenated. */
static int tls_seal_scatter_record(SSL *ssl, uint8_t *out_prefix, uint8_t *out,
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
uint8_t *out_suffix, uint8_t type,
const uint8_t *in, size_t in_len) {
Remove |need_record_splitting| from |SSL3_STATE|. It is redundant given the other state in the connection. Change-Id: I5dc71627132659ab4316a5ea360c9ca480fb7c6c Reviewed-on: https://boringssl-review.googlesource.com/6646 Reviewed-by: Adam Langley <agl@google.com>
2015-12-06 21:07:47 +00:00
if (type == SSL3_RT_APPLICATION_DATA && in_len > 1 &&
ssl_needs_record_splitting(ssl)) {
C++-ify SSL_AEAD_CTX. This adds several utilities as replacements for new and delete and makes bssl::UniquePtr work with our private types. Later work can convert more incrementally. I did this one more aggressively to see how it'd work. Unfortunately, in doing so, I needed to remove the NULL SSL_AEAD_CTX "method" receiver trick to appease clang. The null cipher is now represented by a concrete SSL_AEAD_CTX. The long-lived references to SSL_AEAD_CTX are not yet in types with constructors, so they still bare Delete rather than UniquePtr for now. Though this does mean we may be able to move the sequence number into SSLAEADContext later which is one less object for DTLS to carry around. Bug: 132 Change-Id: I506b404addafb692055d5709b0ca6d5439a4e6be Reviewed-on: https://boringssl-review.googlesource.com/18164 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2017-07-19 03:45:18 +01:00
assert(ssl->s3->aead_write_ctx->ExplicitNonceLen() == 0);
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
const size_t prefix_len = SSL3_RT_HEADER_LENGTH;
/* Write the 1-byte fragment into |out_prefix|. */
uint8_t *split_body = out_prefix + prefix_len;
uint8_t *split_suffix = split_body + 1;
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
if (!do_seal_record(ssl, out_prefix, split_body, split_suffix, type, in,
1)) {
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
return 0;
}
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
size_t split_record_suffix_len;
if (!ssl->s3->aead_write_ctx->SuffixLen(&split_record_suffix_len, 1, 0)) {
assert(false);
return 0;
}
const size_t split_record_len = prefix_len + 1 + split_record_suffix_len;
Move aead_{read,write}_ctx and next_proto_negotiated into ssl->s3. Both are connection state rather than configuration state. Notably this cuts down more of SSL_clear that can't just use ssl_free + ssl_new. Change-Id: I3c05b3ae86d4db8bd75f1cd21656f57fc5b55ca9 Reviewed-on: https://boringssl-review.googlesource.com/6835 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-12-25 20:56:49 +00:00
assert(SSL3_RT_HEADER_LENGTH + ssl_cipher_get_record_split_len(
C++-ify SSL_AEAD_CTX. This adds several utilities as replacements for new and delete and makes bssl::UniquePtr work with our private types. Later work can convert more incrementally. I did this one more aggressively to see how it'd work. Unfortunately, in doing so, I needed to remove the NULL SSL_AEAD_CTX "method" receiver trick to appease clang. The null cipher is now represented by a concrete SSL_AEAD_CTX. The long-lived references to SSL_AEAD_CTX are not yet in types with constructors, so they still bare Delete rather than UniquePtr for now. Though this does mean we may be able to move the sequence number into SSLAEADContext later which is one less object for DTLS to carry around. Bug: 132 Change-Id: I506b404addafb692055d5709b0ca6d5439a4e6be Reviewed-on: https://boringssl-review.googlesource.com/18164 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2017-07-19 03:45:18 +01:00
ssl->s3->aead_write_ctx->cipher()) ==
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
split_record_len);
/* Write the n-1-byte fragment. The header gets split between |out_prefix|
* (header[:-1]) and |out| (header[-1:]). */
uint8_t tmp_prefix[SSL3_RT_HEADER_LENGTH];
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
if (!do_seal_record(ssl, tmp_prefix, out + 1, out_suffix, type, in + 1,
in_len - 1)) {
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
return 0;
}
assert(tls_seal_scatter_prefix_len(ssl, type, in_len) ==
split_record_len + SSL3_RT_HEADER_LENGTH - 1);
OPENSSL_memcpy(out_prefix + split_record_len, tmp_prefix,
SSL3_RT_HEADER_LENGTH - 1);
OPENSSL_memcpy(out, tmp_prefix + SSL3_RT_HEADER_LENGTH - 1, 1);
return 1;
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
}
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
return do_seal_record(ssl, out_prefix, out, out_suffix, type, in, in_len);
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
}
int tls_seal_record(SSL *ssl, uint8_t *out, size_t *out_len, size_t max_out_len,
uint8_t type, const uint8_t *in, size_t in_len) {
if (buffers_alias(in, in_len, out, max_out_len)) {
OPENSSL_PUT_ERROR(SSL, SSL_R_OUTPUT_ALIASES_INPUT);
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
return 0;
}
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
const size_t prefix_len = tls_seal_scatter_prefix_len(ssl, type, in_len);
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
size_t suffix_len;
if (!tls_seal_scatter_suffix_len(ssl, &suffix_len, type, in_len)) {
return false;
}
if (in_len + prefix_len < in_len ||
prefix_len + in_len + suffix_len < prefix_len + in_len) {
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
OPENSSL_PUT_ERROR(SSL, SSL_R_RECORD_TOO_LARGE);
return 0;
}
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
if (max_out_len < in_len + prefix_len + suffix_len) {
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL);
return 0;
}
uint8_t *prefix = out;
uint8_t *body = out + prefix_len;
uint8_t *suffix = body + in_len;
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
if (!tls_seal_scatter_record(ssl, prefix, body, suffix, type, in, in_len)) {
Add SSL_AEAD_CTX_seal_scatter. This plumbs EVP_AEAD_CTX_seal_scatter all the way through to tls_record.c, so we can add a new zero-copy record sealing method on top of the existing code. Change-Id: I01fdd88abef5442dc16605ea31b29b4b1231c073 Reviewed-on: https://boringssl-review.googlesource.com/17684 Reviewed-by: Adam Langley <agl@google.com>
2017-06-30 13:29:50 +01:00
return 0;
}
*out_len = prefix_len + in_len + suffix_len;
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
return 1;
}
Tidy up keyblock and CCS logic slightly. Move the actual SSL_AEAD_CTX swap into the record layer. Also revise the intermediate state we store between setup_key_block and change_cipher_state. With SSL_AEAD_CTX_new abstracted out, keeping the EVP_AEAD around doesn't make much sense. Just store enough to partition the key block. Change-Id: I773fb46a2cb78fa570f00c0a89339c15bbb1d719 Reviewed-on: https://boringssl-review.googlesource.com/6832 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-12-25 20:34:23 +00:00
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
enum ssl_open_record_t ssl_process_alert(SSL *ssl, uint8_t *out_alert,
const uint8_t *in, size_t in_len) {
/* Alerts records may not contain fragmented or multiple alerts. */
if (in_len != 2) {
*out_alert = SSL_AD_DECODE_ERROR;
OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ALERT);
return ssl_open_record_error;
}
Take the version parameter out of ssl_do_msg_callback. This will make it a little easier to store the normalized version rather than the wire version. Also document the V2ClientHello behavior. Change-Id: I5ce9ccce44ca48be2e60ddf293c0fab6bba1356e Reviewed-on: https://boringssl-review.googlesource.com/11121 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-09-20 01:15:07 +01:00
ssl_do_msg_callback(ssl, 0 /* read */, SSL3_RT_ALERT, in, in_len);
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
const uint8_t alert_level = in[0];
const uint8_t alert_descr = in[1];
uint16_t alert = (alert_level << 8) | alert_descr;
ssl_do_info_callback(ssl, SSL_CB_READ_ALERT, alert);
if (alert_level == SSL3_AL_WARNING) {
if (alert_descr == SSL_AD_CLOSE_NOTIFY) {
ssl->s3->recv_shutdown = ssl_shutdown_close_notify;
return ssl_open_record_close_notify;
}
Reject warning alerts in TLS 1.3. As of https://github.com/tlswg/tls13-spec/pull/530, they're gone. They're still allowed just before the ClientHello or ServerHello, which is kind of odd, but so it goes. BUG=86 Change-Id: I3d556ab45e42d0755d23566e006c0db9af35b7b6 Reviewed-on: https://boringssl-review.googlesource.com/9114 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-08-03 20:39:47 +01:00
/* Warning alerts do not exist in TLS 1.3. */
if (ssl->s3->have_version &&
ssl3_protocol_version(ssl) >= TLS1_3_VERSION) {
*out_alert = SSL_AD_DECODE_ERROR;
OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ALERT);
return ssl_open_record_error;
}
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
ssl->s3->warning_alert_count++;
if (ssl->s3->warning_alert_count > kMaxWarningAlerts) {
*out_alert = SSL_AD_UNEXPECTED_MESSAGE;
OPENSSL_PUT_ERROR(SSL, SSL_R_TOO_MANY_WARNING_ALERTS);
return ssl_open_record_error;
}
return ssl_open_record_discard;
}
if (alert_level == SSL3_AL_FATAL) {
ssl->s3->recv_shutdown = ssl_shutdown_fatal_alert;
char tmp[16];
OPENSSL_PUT_ERROR(SSL, SSL_AD_REASON_OFFSET + alert_descr);
BIO_snprintf(tmp, sizeof(tmp), "%d", alert_descr);
ERR_add_error_data(2, "SSL alert number ", tmp);
return ssl_open_record_fatal_alert;
}
*out_alert = SSL_AD_ILLEGAL_PARAMETER;
OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_ALERT_TYPE);
return ssl_open_record_error;
}
Move libssl's internals into the bssl namespace. This is horrible, but everything else I tried was worse. The goal with this CL is to take the extern "C" out of ssl/internal.h and move most symbols to namespace bssl, so we can start using C++ helpers and destructors without worry. Complications: - Public API functions must be extern "C" and match their declaration in ssl.h, which is unnamespaced. C++ really does not want you to interleave namespaced and unnamespaced things. One can actually write a namespaced extern "C" function, but this means, from C++'s perspective, the function is namespaced. Trying to namespace the public header would worked but ended up too deep a rabbithole. - Our STACK_OF macros do not work right in namespaces. - The typedefs for our exposed but opaque types are visible in the header files and copied into consuming projects as forward declarations. We ultimately want to give SSL a destructor, but clobbering an unnamespaced ssl_st::~ssl_st seems bad manners. - MSVC complains about ambiguous names if one typedefs SSL to bssl::SSL. This CL opts for: - ssl/*.cc must begin with #define BORINGSSL_INTERNAL_CXX_TYPES. This informs the public headers to create forward declarations which are compatible with our namespaces. - For now, C++-defined type FOO ends up at bssl::FOO with a typedef outside. Later I imagine we'll rename many of them. - Internal functions get namespace bssl, so we stop worrying about stomping the tls1_prf symbol. Exported C functions are stuck as they are. Rather than try anything weird, bite the bullet and reorder files which have a mix of public and private functions. I expect that over time, the public functions will become fairly small as we move logic to more idiomatic C++. Files without any public C functions can just be written normally. - To avoid MSVC troubles, some bssl types are renamed to CPlusPlusStyle in advance of them being made idiomatic C++. Bug: 132 Change-Id: Ic931895e117c38b14ff8d6e5a273e868796c7581 Reviewed-on: https://boringssl-review.googlesource.com/18124 Reviewed-by: David Benjamin <davidben@google.com>
2017-07-18 21:34:25 +01:00
Add bssl::SealRecord and bssl::OpenRecord. This is a C++ interface for encrypting and decrypting TLS application data records in-place, wrapping the existing C API in tls_record.cc. Also add bssl::Span, a non-owning reference to a contiguous array of elements which can be used as a common interface over contiguous container types (like std::vector), pointer-length-pairs, arrays, etc. Change-Id: Iaa2ca4957cde511cb734b997db38f54e103b0d92 Reviewed-on: https://boringssl-review.googlesource.com/18104 Commit-Queue: Martin Kreichgauer <martinkr@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-07-18 20:42:18 +01:00
OpenRecordResult OpenRecord(SSL *ssl, Span<uint8_t> *out,
size_t *out_record_len, uint8_t *out_alert,
const Span<uint8_t> in) {
// This API is a work in progress and currently only works for TLS 1.2 servers
// and below.
if (SSL_in_init(ssl) ||
SSL_is_dtls(ssl) ||
ssl3_protocol_version(ssl) > TLS1_2_VERSION) {
assert(false);
*out_alert = SSL_AD_INTERNAL_ERROR;
return OpenRecordResult::kError;
}
*out = Span<uint8_t>();
*out_record_len = 0;
CBS plaintext;
uint8_t type;
size_t record_len;
const ssl_open_record_t result = tls_open_record(
ssl, &type, &plaintext, &record_len, out_alert, in.data(), in.size());
if (type != SSL3_RT_APPLICATION_DATA && type != SSL3_RT_ALERT) {
*out_alert = SSL_AD_UNEXPECTED_MESSAGE;
return OpenRecordResult::kError;
}
OpenRecordResult ret = OpenRecordResult::kError;
switch (result) {
case ssl_open_record_success:
ret = OpenRecordResult::kOK;
break;
case ssl_open_record_discard:
ret = OpenRecordResult::kDiscard;
break;
case ssl_open_record_partial:
ret = OpenRecordResult::kIncompleteRecord;
break;
case ssl_open_record_close_notify:
ret = OpenRecordResult::kAlertCloseNotify;
break;
case ssl_open_record_fatal_alert:
ret = OpenRecordResult::kAlertFatal;
break;
case ssl_open_record_error:
ret = OpenRecordResult::kError;
break;
}
*out =
MakeSpan(const_cast<uint8_t*>(CBS_data(&plaintext)), CBS_len(&plaintext));
*out_record_len = record_len;
return ret;
}
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
size_t SealRecordPrefixLen(const SSL *ssl, const size_t record_len) {
Add bssl::SealRecord and bssl::OpenRecord. This is a C++ interface for encrypting and decrypting TLS application data records in-place, wrapping the existing C API in tls_record.cc. Also add bssl::Span, a non-owning reference to a contiguous array of elements which can be used as a common interface over contiguous container types (like std::vector), pointer-length-pairs, arrays, etc. Change-Id: Iaa2ca4957cde511cb734b997db38f54e103b0d92 Reviewed-on: https://boringssl-review.googlesource.com/18104 Commit-Queue: Martin Kreichgauer <martinkr@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-07-18 20:42:18 +01:00
return tls_seal_scatter_prefix_len(ssl, SSL3_RT_APPLICATION_DATA, record_len);
}
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
size_t SealRecordSuffixLen(const SSL *ssl, const size_t plaintext_len) {
assert(plaintext_len <= SSL3_RT_MAX_PLAIN_LENGTH);
size_t suffix_len;
if (!tls_seal_scatter_suffix_len(ssl, &suffix_len, SSL3_RT_APPLICATION_DATA,
plaintext_len)) {
assert(false);
OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
return 0;
}
assert(suffix_len <= SSL3_RT_MAX_ENCRYPTED_OVERHEAD);
return suffix_len;
Add bssl::SealRecord and bssl::OpenRecord. This is a C++ interface for encrypting and decrypting TLS application data records in-place, wrapping the existing C API in tls_record.cc. Also add bssl::Span, a non-owning reference to a contiguous array of elements which can be used as a common interface over contiguous container types (like std::vector), pointer-length-pairs, arrays, etc. Change-Id: Iaa2ca4957cde511cb734b997db38f54e103b0d92 Reviewed-on: https://boringssl-review.googlesource.com/18104 Commit-Queue: Martin Kreichgauer <martinkr@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-07-18 20:42:18 +01:00
}
bool SealRecord(SSL *ssl, const Span<uint8_t> out_prefix,
const Span<uint8_t> out, Span<uint8_t> out_suffix,
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
const Span<const uint8_t> in) {
Add bssl::SealRecord and bssl::OpenRecord. This is a C++ interface for encrypting and decrypting TLS application data records in-place, wrapping the existing C API in tls_record.cc. Also add bssl::Span, a non-owning reference to a contiguous array of elements which can be used as a common interface over contiguous container types (like std::vector), pointer-length-pairs, arrays, etc. Change-Id: Iaa2ca4957cde511cb734b997db38f54e103b0d92 Reviewed-on: https://boringssl-review.googlesource.com/18104 Commit-Queue: Martin Kreichgauer <martinkr@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-07-18 20:42:18 +01:00
// This API is a work in progress and currently only works for TLS 1.2 servers
// and below.
if (SSL_in_init(ssl) ||
SSL_is_dtls(ssl) ||
ssl3_protocol_version(ssl) > TLS1_2_VERSION) {
assert(false);
OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
return false;
}
if (out_prefix.size() != SealRecordPrefixLen(ssl, in.size()) ||
out.size() != in.size() ||
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
out_suffix.size() != SealRecordSuffixLen(ssl, in.size())) {
Add bssl::SealRecord and bssl::OpenRecord. This is a C++ interface for encrypting and decrypting TLS application data records in-place, wrapping the existing C API in tls_record.cc. Also add bssl::Span, a non-owning reference to a contiguous array of elements which can be used as a common interface over contiguous container types (like std::vector), pointer-length-pairs, arrays, etc. Change-Id: Iaa2ca4957cde511cb734b997db38f54e103b0d92 Reviewed-on: https://boringssl-review.googlesource.com/18104 Commit-Queue: Martin Kreichgauer <martinkr@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-07-18 20:42:18 +01:00
OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL);
return false;
}
Make the bssl::SealRecord out_suffix arg fixed length. Similarly, add EVP_AEAD_CTX_tag_len which computes the exact tag length for required by EVP_AEAD_CTX_seal_scatter. Change-Id: I069b0ad16fab314fd42f6048a3c1dc45e8376f7f Reviewed-on: https://boringssl-review.googlesource.com/18324 Reviewed-by: Adam Langley <agl@google.com>
2017-07-22 00:27:54 +01:00
return tls_seal_scatter_record(ssl, out_prefix.data(), out.data(),
out_suffix.data(), SSL3_RT_APPLICATION_DATA,
in.data(), in.size());
Add bssl::SealRecord and bssl::OpenRecord. This is a C++ interface for encrypting and decrypting TLS application data records in-place, wrapping the existing C API in tls_record.cc. Also add bssl::Span, a non-owning reference to a contiguous array of elements which can be used as a common interface over contiguous container types (like std::vector), pointer-length-pairs, arrays, etc. Change-Id: Iaa2ca4957cde511cb734b997db38f54e103b0d92 Reviewed-on: https://boringssl-review.googlesource.com/18104 Commit-Queue: Martin Kreichgauer <martinkr@google.com> Reviewed-by: Adam Langley <agl@google.com>
2017-07-18 20:42:18 +01:00
}
Move libssl's internals into the bssl namespace. This is horrible, but everything else I tried was worse. The goal with this CL is to take the extern "C" out of ssl/internal.h and move most symbols to namespace bssl, so we can start using C++ helpers and destructors without worry. Complications: - Public API functions must be extern "C" and match their declaration in ssl.h, which is unnamespaced. C++ really does not want you to interleave namespaced and unnamespaced things. One can actually write a namespaced extern "C" function, but this means, from C++'s perspective, the function is namespaced. Trying to namespace the public header would worked but ended up too deep a rabbithole. - Our STACK_OF macros do not work right in namespaces. - The typedefs for our exposed but opaque types are visible in the header files and copied into consuming projects as forward declarations. We ultimately want to give SSL a destructor, but clobbering an unnamespaced ssl_st::~ssl_st seems bad manners. - MSVC complains about ambiguous names if one typedefs SSL to bssl::SSL. This CL opts for: - ssl/*.cc must begin with #define BORINGSSL_INTERNAL_CXX_TYPES. This informs the public headers to create forward declarations which are compatible with our namespaces. - For now, C++-defined type FOO ends up at bssl::FOO with a typedef outside. Later I imagine we'll rename many of them. - Internal functions get namespace bssl, so we stop worrying about stomping the tls1_prf symbol. Exported C functions are stuck as they are. Rather than try anything weird, bite the bullet and reorder files which have a mix of public and private functions. I expect that over time, the public functions will become fairly small as we move logic to more idiomatic C++. Files without any public C functions can just be written normally. - To avoid MSVC troubles, some bssl types are renamed to CPlusPlusStyle in advance of them being made idiomatic C++. Bug: 132 Change-Id: Ic931895e117c38b14ff8d6e5a273e868796c7581 Reviewed-on: https://boringssl-review.googlesource.com/18124 Reviewed-by: David Benjamin <davidben@google.com>
2017-07-18 21:34:25 +01:00
} // namespace bssl
using namespace bssl;
size_t SSL_max_seal_overhead(const SSL *ssl) {
if (SSL_is_dtls(ssl)) {
return dtls_max_seal_overhead(ssl, dtls1_use_current_epoch);
}
size_t ret = SSL3_RT_HEADER_LENGTH;
C++-ify SSL_AEAD_CTX. This adds several utilities as replacements for new and delete and makes bssl::UniquePtr work with our private types. Later work can convert more incrementally. I did this one more aggressively to see how it'd work. Unfortunately, in doing so, I needed to remove the NULL SSL_AEAD_CTX "method" receiver trick to appease clang. The null cipher is now represented by a concrete SSL_AEAD_CTX. The long-lived references to SSL_AEAD_CTX are not yet in types with constructors, so they still bare Delete rather than UniquePtr for now. Though this does mean we may be able to move the sequence number into SSLAEADContext later which is one less object for DTLS to carry around. Bug: 132 Change-Id: I506b404addafb692055d5709b0ca6d5439a4e6be Reviewed-on: https://boringssl-review.googlesource.com/18164 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2017-07-19 03:45:18 +01:00
ret += ssl->s3->aead_write_ctx->MaxOverhead();
Move libssl's internals into the bssl namespace. This is horrible, but everything else I tried was worse. The goal with this CL is to take the extern "C" out of ssl/internal.h and move most symbols to namespace bssl, so we can start using C++ helpers and destructors without worry. Complications: - Public API functions must be extern "C" and match their declaration in ssl.h, which is unnamespaced. C++ really does not want you to interleave namespaced and unnamespaced things. One can actually write a namespaced extern "C" function, but this means, from C++'s perspective, the function is namespaced. Trying to namespace the public header would worked but ended up too deep a rabbithole. - Our STACK_OF macros do not work right in namespaces. - The typedefs for our exposed but opaque types are visible in the header files and copied into consuming projects as forward declarations. We ultimately want to give SSL a destructor, but clobbering an unnamespaced ssl_st::~ssl_st seems bad manners. - MSVC complains about ambiguous names if one typedefs SSL to bssl::SSL. This CL opts for: - ssl/*.cc must begin with #define BORINGSSL_INTERNAL_CXX_TYPES. This informs the public headers to create forward declarations which are compatible with our namespaces. - For now, C++-defined type FOO ends up at bssl::FOO with a typedef outside. Later I imagine we'll rename many of them. - Internal functions get namespace bssl, so we stop worrying about stomping the tls1_prf symbol. Exported C functions are stuck as they are. Rather than try anything weird, bite the bullet and reorder files which have a mix of public and private functions. I expect that over time, the public functions will become fairly small as we move logic to more idiomatic C++. Files without any public C functions can just be written normally. - To avoid MSVC troubles, some bssl types are renamed to CPlusPlusStyle in advance of them being made idiomatic C++. Bug: 132 Change-Id: Ic931895e117c38b14ff8d6e5a273e868796c7581 Reviewed-on: https://boringssl-review.googlesource.com/18124 Reviewed-by: David Benjamin <davidben@google.com>
2017-07-18 21:34:25 +01:00
/* TLS 1.3 needs an extra byte for the encrypted record type. */
C++-ify SSL_AEAD_CTX. This adds several utilities as replacements for new and delete and makes bssl::UniquePtr work with our private types. Later work can convert more incrementally. I did this one more aggressively to see how it'd work. Unfortunately, in doing so, I needed to remove the NULL SSL_AEAD_CTX "method" receiver trick to appease clang. The null cipher is now represented by a concrete SSL_AEAD_CTX. The long-lived references to SSL_AEAD_CTX are not yet in types with constructors, so they still bare Delete rather than UniquePtr for now. Though this does mean we may be able to move the sequence number into SSLAEADContext later which is one less object for DTLS to carry around. Bug: 132 Change-Id: I506b404addafb692055d5709b0ca6d5439a4e6be Reviewed-on: https://boringssl-review.googlesource.com/18164 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2017-07-19 03:45:18 +01:00
if (!ssl->s3->aead_write_ctx->is_null_cipher() &&
ssl->s3->aead_write_ctx->version() >= TLS1_3_VERSION) {
Move libssl's internals into the bssl namespace. This is horrible, but everything else I tried was worse. The goal with this CL is to take the extern "C" out of ssl/internal.h and move most symbols to namespace bssl, so we can start using C++ helpers and destructors without worry. Complications: - Public API functions must be extern "C" and match their declaration in ssl.h, which is unnamespaced. C++ really does not want you to interleave namespaced and unnamespaced things. One can actually write a namespaced extern "C" function, but this means, from C++'s perspective, the function is namespaced. Trying to namespace the public header would worked but ended up too deep a rabbithole. - Our STACK_OF macros do not work right in namespaces. - The typedefs for our exposed but opaque types are visible in the header files and copied into consuming projects as forward declarations. We ultimately want to give SSL a destructor, but clobbering an unnamespaced ssl_st::~ssl_st seems bad manners. - MSVC complains about ambiguous names if one typedefs SSL to bssl::SSL. This CL opts for: - ssl/*.cc must begin with #define BORINGSSL_INTERNAL_CXX_TYPES. This informs the public headers to create forward declarations which are compatible with our namespaces. - For now, C++-defined type FOO ends up at bssl::FOO with a typedef outside. Later I imagine we'll rename many of them. - Internal functions get namespace bssl, so we stop worrying about stomping the tls1_prf symbol. Exported C functions are stuck as they are. Rather than try anything weird, bite the bullet and reorder files which have a mix of public and private functions. I expect that over time, the public functions will become fairly small as we move logic to more idiomatic C++. Files without any public C functions can just be written normally. - To avoid MSVC troubles, some bssl types are renamed to CPlusPlusStyle in advance of them being made idiomatic C++. Bug: 132 Change-Id: Ic931895e117c38b14ff8d6e5a273e868796c7581 Reviewed-on: https://boringssl-review.googlesource.com/18124 Reviewed-by: David Benjamin <davidben@google.com>
2017-07-18 21:34:25 +01:00
ret += 1;
}
if (ssl_needs_record_splitting(ssl)) {
ret *= 2;
}
return ret;
}
Reference in New Issue Copy Permalink