From b5172a722ccb62e5bdd893e9d4c6741b8425c942 Mon Sep 17 00:00:00 2001 From: David Benjamin Date: Thu, 17 Nov 2016 17:01:01 +0900 Subject: [PATCH] Make tls1_setup_key_block static. It is not called outside of t1_enc.c. Change-Id: Ifd9d109eeb432e931361ebdf456243c490b93ecf Reviewed-on: https://boringssl-review.googlesource.com/12340 Reviewed-by: Steven Valdez Reviewed-by: David Benjamin Commit-Queue: David Benjamin CQ-Verified: CQ bot account: commit-bot@chromium.org --- ssl/internal.h | 1 - ssl/t1_enc.c | 114 ++++++++++++++++++++++++------------------------- 2 files changed, 57 insertions(+), 58 deletions(-) diff --git a/ssl/internal.h b/ssl/internal.h index 310abee0..7e505db8 100644 --- a/ssl/internal.h +++ b/ssl/internal.h @@ -1826,7 +1826,6 @@ int ssl_init_wbio_buffer(SSL *ssl); void ssl_free_wbio_buffer(SSL *ssl); int tls1_change_cipher_state(SSL *ssl, int which); -int tls1_setup_key_block(SSL *ssl); int tls1_handshake_digest(SSL *ssl, uint8_t *out, size_t out_len); int tls1_generate_master_secret(SSL *ssl, uint8_t *out, const uint8_t *premaster, size_t premaster_len); diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c index bf5c0695..4c7d3ee3 100644 --- a/ssl/t1_enc.c +++ b/ssl/t1_enc.c @@ -258,6 +258,63 @@ static int tls1_prf(const SSL *ssl, uint8_t *out, size_t out_len, return 1; } +static int tls1_setup_key_block(SSL *ssl) { + if (ssl->s3->hs->key_block_len != 0) { + return 1; + } + + SSL_SESSION *session = ssl->session; + if (ssl->s3->new_session != NULL) { + session = ssl->s3->new_session; + } + + const EVP_AEAD *aead = NULL; + size_t mac_secret_len, fixed_iv_len; + if (session->cipher == NULL || + !ssl_cipher_get_evp_aead(&aead, &mac_secret_len, &fixed_iv_len, + session->cipher, ssl3_protocol_version(ssl))) { + OPENSSL_PUT_ERROR(SSL, SSL_R_CIPHER_OR_HASH_UNAVAILABLE); + return 0; + } + size_t key_len = EVP_AEAD_key_length(aead); + if (mac_secret_len > 0) { + /* For "stateful" AEADs (i.e. compatibility with pre-AEAD cipher suites) the + * key length reported by |EVP_AEAD_key_length| will include the MAC key + * bytes and initial implicit IV. */ + if (key_len < mac_secret_len + fixed_iv_len) { + OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); + return 0; + } + key_len -= mac_secret_len + fixed_iv_len; + } + + assert(mac_secret_len < 256); + assert(key_len < 256); + assert(fixed_iv_len < 256); + + ssl->s3->tmp.new_mac_secret_len = (uint8_t)mac_secret_len; + ssl->s3->tmp.new_key_len = (uint8_t)key_len; + ssl->s3->tmp.new_fixed_iv_len = (uint8_t)fixed_iv_len; + + size_t key_block_len = SSL_get_key_block_len(ssl); + + uint8_t *keyblock = OPENSSL_malloc(key_block_len); + if (keyblock == NULL) { + OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); + return 0; + } + + if (!SSL_generate_key_block(ssl, keyblock, key_block_len)) { + OPENSSL_free(keyblock); + return 0; + } + + assert(key_block_len < 256); + ssl->s3->hs->key_block_len = (uint8_t)key_block_len; + ssl->s3->hs->key_block = keyblock; + return 1; +} + int tls1_change_cipher_state(SSL *ssl, int which) { /* Ensure the key block is set up. */ if (!tls1_setup_key_block(ssl)) { @@ -332,63 +389,6 @@ int SSL_generate_key_block(const SSL *ssl, uint8_t *out, size_t out_len) { ssl->s3->client_random, SSL3_RANDOM_SIZE); } -int tls1_setup_key_block(SSL *ssl) { - if (ssl->s3->hs->key_block_len != 0) { - return 1; - } - - SSL_SESSION *session = ssl->session; - if (ssl->s3->new_session != NULL) { - session = ssl->s3->new_session; - } - - const EVP_AEAD *aead = NULL; - size_t mac_secret_len, fixed_iv_len; - if (session->cipher == NULL || - !ssl_cipher_get_evp_aead(&aead, &mac_secret_len, &fixed_iv_len, - session->cipher, ssl3_protocol_version(ssl))) { - OPENSSL_PUT_ERROR(SSL, SSL_R_CIPHER_OR_HASH_UNAVAILABLE); - return 0; - } - size_t key_len = EVP_AEAD_key_length(aead); - if (mac_secret_len > 0) { - /* For "stateful" AEADs (i.e. compatibility with pre-AEAD cipher suites) the - * key length reported by |EVP_AEAD_key_length| will include the MAC key - * bytes and initial implicit IV. */ - if (key_len < mac_secret_len + fixed_iv_len) { - OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); - return 0; - } - key_len -= mac_secret_len + fixed_iv_len; - } - - assert(mac_secret_len < 256); - assert(key_len < 256); - assert(fixed_iv_len < 256); - - ssl->s3->tmp.new_mac_secret_len = (uint8_t)mac_secret_len; - ssl->s3->tmp.new_key_len = (uint8_t)key_len; - ssl->s3->tmp.new_fixed_iv_len = (uint8_t)fixed_iv_len; - - size_t key_block_len = SSL_get_key_block_len(ssl); - - uint8_t *keyblock = OPENSSL_malloc(key_block_len); - if (keyblock == NULL) { - OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); - return 0; - } - - if (!SSL_generate_key_block(ssl, keyblock, key_block_len)) { - OPENSSL_free(keyblock); - return 0; - } - - assert(key_block_len < 256); - ssl->s3->hs->key_block_len = (uint8_t)key_block_len; - ssl->s3->hs->key_block = keyblock; - return 1; -} - static int append_digest(const EVP_MD_CTX *ctx, uint8_t *out, size_t *out_len, size_t max_out) { int ret = 0;