1 files changed, 343 insertions, 5 deletions

diff --git a/lib/libssl/tls12_record_layer.c b/lib/libssl/tls12_record_layer.c
index 10d0f1194b4..56ff94d95c9 100644
--- a/lib/libssl/tls12_record_layer.c
+++ b/lib/libssl/tls12_record_layer.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls12_record_layer.c,v 1.4 2020/09/16 17:15:01 jsing Exp $ */
+/* $OpenBSD: tls12_record_layer.c,v 1.5 2020/10/03 17:35:17 jsing Exp $ */
 /*
  * Copyright (c) 2020 Joel Sing <jsing@openbsd.org>
  *
@@ -25,6 +25,8 @@ struct tls12_record_layer {
 	uint16_t version;
 	int dtls;
 
+	uint8_t alert_desc;
+
 	uint16_t read_epoch;
 	uint16_t write_epoch;
 
@@ -43,6 +45,9 @@ struct tls12_record_layer {
 	EVP_CIPHER_CTX *write_cipher_ctx;
 	EVP_MD_CTX *write_hash_ctx;
 
+	const uint8_t *read_mac_key;
+	size_t read_mac_key_len;
+
 	uint8_t *read_seq_num;
 	uint8_t *write_seq_num;
 };
@@ -65,6 +70,12 @@ tls12_record_layer_free(struct tls12_record_layer *rl)
 }
 
 void
+tls12_record_layer_alert(struct tls12_record_layer *rl, uint8_t *alert_desc)
+{
+	*alert_desc = rl->alert_desc;
+}
+
+void
 tls12_record_layer_set_version(struct tls12_record_layer *rl, uint16_t version)
 {
 	rl->version = version;
@@ -111,6 +122,7 @@ void
 tls12_record_layer_clear_read_state(struct tls12_record_layer *rl)
 {
 	tls12_record_layer_set_read_state(rl, NULL, NULL, NULL, 0);
+	tls12_record_layer_set_read_mac_key(rl, NULL, 0);
 	rl->read_seq_num = NULL;
 }
 
@@ -173,6 +185,16 @@ tls12_record_layer_set_write_cipher_hash(struct tls12_record_layer *rl,
 	return 1;
 }
 
+int
+tls12_record_layer_set_read_mac_key(struct tls12_record_layer *rl,
+    const uint8_t *mac_key, size_t mac_key_len)
+{
+	rl->read_mac_key = mac_key;
+	rl->read_mac_key_len = mac_key_len;
+
+	return 1;
+}
+
 static int
 tls12_record_layer_build_seq_num(struct tls12_record_layer *rl, CBB *cbb,
     uint16_t epoch, uint8_t *seq_num, size_t seq_num_len)
@@ -234,7 +256,7 @@ tls12_record_layer_mac(struct tls12_record_layer *rl, CBB *cbb,
 {
 	EVP_MD_CTX *mac_ctx = NULL;
 	uint8_t *header = NULL;
-	size_t header_len;
+	size_t header_len = 0;
 	size_t mac_len;
 	uint8_t *mac;
 	int ret = 0;
@@ -258,6 +280,8 @@ tls12_record_layer_mac(struct tls12_record_layer *rl, CBB *cbb,
 		goto err;
 	if (EVP_DigestSignFinal(mac_ctx, mac, &mac_len) <= 0)
 		goto err;
+	if (mac_len == 0)
+		goto err;
 
 	if (stream_mac) {
 		if (!EVP_MD_CTX_copy(hash_ctx, mac_ctx))
@@ -269,12 +293,67 @@ tls12_record_layer_mac(struct tls12_record_layer *rl, CBB *cbb,
 
  err:
 	EVP_MD_CTX_free(mac_ctx);
-	free(header);
+	freezero(header, header_len);
 
 	return ret;
 }
 
 static int
+tls12_record_layer_read_mac_cbc(struct tls12_record_layer *rl, CBB *cbb,
+    uint8_t content_type, const uint8_t *content, size_t content_len,
+    size_t mac_len, size_t padding_len)
+{
+	uint8_t *header = NULL;
+	size_t header_len = 0;
+	uint8_t *mac = NULL;
+	size_t out_mac_len = 0;
+	int ret = 0;
+
+	/*
+	 * Must be constant time to avoid leaking details about CBC padding.
+	 */
+
+	if (!ssl3_cbc_record_digest_supported(rl->read_hash_ctx))
+		goto err;
+
+	if (!tls12_record_layer_pseudo_header(rl, content_type, content_len,
+	    rl->read_epoch, rl->read_seq_num, SSL3_SEQUENCE_SIZE,
+	    &header, &header_len))
+		goto err;
+
+	if (!CBB_add_space(cbb, &mac, mac_len))
+		goto err;
+	if (!ssl3_cbc_digest_record(rl->read_hash_ctx, mac, &out_mac_len, header,
+	    content, content_len + mac_len, content_len + mac_len + padding_len,
+	    rl->read_mac_key, rl->read_mac_key_len))
+		goto err;
+	if (mac_len != out_mac_len)
+		goto err;
+
+	ret = 1;
+
+ err:
+	freezero(header, header_len);
+
+	return ret;
+}
+
+static int
+tls12_record_layer_read_mac(struct tls12_record_layer *rl, CBB *cbb,
+    uint8_t content_type, const uint8_t *content, size_t content_len)
+{
+	EVP_CIPHER_CTX *enc = rl->read_cipher_ctx;
+	size_t out_len;
+
+	if (EVP_CIPHER_CTX_mode(enc) == EVP_CIPH_CBC_MODE)
+		return 0;
+
+	return tls12_record_layer_mac(rl, cbb, rl->read_hash_ctx,
+	    rl->read_stream_mac, rl->read_epoch, rl->read_seq_num,
+	    SSL3_SEQUENCE_SIZE, content_type, content, content_len, &out_len);
+}
+
+static int
 tls12_record_layer_write_mac(struct tls12_record_layer *rl, CBB *cbb,
     uint8_t content_type, const uint8_t *content, size_t content_len,
     size_t *out_len)
@@ -286,7 +365,8 @@ tls12_record_layer_write_mac(struct tls12_record_layer *rl, CBB *cbb,
 
 static int
 tls12_record_layer_aead_concat_nonce(struct tls12_record_layer *rl,
-    const SSL_AEAD_CTX *aead, uint8_t *seq_num, uint8_t **out, size_t *out_len)
+    const SSL_AEAD_CTX *aead, const uint8_t *seq_num,
+    uint8_t **out, size_t *out_len)
 {
 	CBB cbb;
 
@@ -314,7 +394,8 @@ tls12_record_layer_aead_concat_nonce(struct tls12_record_layer *rl,
 
 static int
 tls12_record_layer_aead_xored_nonce(struct tls12_record_layer *rl,
-    const SSL_AEAD_CTX *aead, uint8_t *seq_num, uint8_t **out, size_t *out_len)
+    const SSL_AEAD_CTX *aead, const uint8_t *seq_num,
+    uint8_t **out, size_t *out_len)
 {
 	uint8_t *nonce = NULL;
 	size_t nonce_len = 0;
@@ -357,6 +438,263 @@ tls12_record_layer_aead_xored_nonce(struct tls12_record_layer *rl,
 }
 
 static int
+tls12_record_layer_open_record_plaintext(struct tls12_record_layer *rl,
+    uint8_t content_type, CBS *fragment, uint8_t **out, size_t *out_len)
+{
+	if (rl->read_aead_ctx != NULL || rl->read_cipher_ctx != NULL)
+		return 0;
+
+	/* XXX - decrypt/process in place for now. */
+	*out = (uint8_t *)CBS_data(fragment);
+	*out_len = CBS_len(fragment);
+
+	return 1;
+}
+
+static int
+tls12_record_layer_open_record_protected_aead(struct tls12_record_layer *rl,
+    uint8_t content_type, CBS *fragment, uint8_t **out, size_t *out_len)
+{
+	const SSL_AEAD_CTX *aead = rl->read_aead_ctx;
+	uint8_t *header = NULL, *nonce = NULL;
+	size_t header_len = 0, nonce_len = 0;
+	uint8_t *plain;
+	size_t plain_len;
+	uint16_t epoch = 0;
+	CBS var_nonce;
+	int ret = 0;
+
+	/* XXX - move to nonce allocated in record layer, matching TLSv1.3 */
+	if (aead->xor_fixed_nonce) {
+		if (!tls12_record_layer_aead_xored_nonce(rl, aead,
+		    rl->read_seq_num, &nonce, &nonce_len))
+			goto err;
+	} else if (aead->variable_nonce_in_record) {
+		if (!CBS_get_bytes(fragment, &var_nonce,
+		    aead->variable_nonce_len))
+			goto err;
+		if (!tls12_record_layer_aead_concat_nonce(rl, aead,
+		    CBS_data(&var_nonce), &nonce, &nonce_len))
+			goto err;
+	} else {
+		if (!tls12_record_layer_aead_concat_nonce(rl, aead,
+		    rl->read_seq_num, &nonce, &nonce_len))
+			goto err;
+	}
+
+	/* XXX EVP_AEAD_max_tag_len vs EVP_AEAD_CTX_tag_len. */
+	if (CBS_len(fragment) < aead->tag_len) {
+		rl->alert_desc = SSL_AD_BAD_RECORD_MAC;
+		goto err;
+	}
+	if (CBS_len(fragment) > SSL3_RT_MAX_ENCRYPTED_LENGTH) {
+		rl->alert_desc = SSL_AD_RECORD_OVERFLOW;
+		goto err;
+	}
+
+	/* XXX - decrypt/process in place for now. */
+	plain = (uint8_t *)CBS_data(fragment);
+	plain_len = CBS_len(fragment) - aead->tag_len;
+
+	if (!tls12_record_layer_pseudo_header(rl, content_type, plain_len,
+	    epoch, rl->read_seq_num, SSL3_SEQUENCE_SIZE, &header, &header_len))
+		goto err;
+
+	if (!EVP_AEAD_CTX_open(&aead->ctx, plain, out_len, plain_len,
+	    nonce, nonce_len, CBS_data(fragment), CBS_len(fragment),
+	    header, header_len)) {
+		rl->alert_desc = SSL_AD_BAD_RECORD_MAC;
+		goto err;
+	}
+
+	if (*out_len > SSL3_RT_MAX_PLAIN_LENGTH) {
+		rl->alert_desc = SSL_AD_RECORD_OVERFLOW;
+		goto err;
+	}
+
+	if (*out_len != plain_len)
+		goto err;
+
+	*out = plain;
+
+	ret = 1;
+
+ err:
+	freezero(header, header_len);
+	freezero(nonce, nonce_len);
+
+	return ret;
+}
+
+static int
+tls12_record_layer_open_record_protected_cipher(struct tls12_record_layer *rl,
+    uint8_t content_type, CBS *fragment, uint8_t **out, size_t *out_len)
+{
+	EVP_CIPHER_CTX *enc = rl->read_cipher_ctx;
+	SSL3_RECORD_INTERNAL rrec;
+	int block_size, eiv_len;
+	uint8_t *mac = NULL;
+	int mac_len = 0;
+	uint8_t *out_mac = NULL;
+	size_t out_mac_len = 0;
+	uint8_t *plain;
+	size_t plain_len;
+	size_t min_len;
+	CBB cbb_mac;
+	int ret = 0;
+
+	memset(&cbb_mac, 0, sizeof(cbb_mac));
+
+	block_size = EVP_CIPHER_CTX_block_size(enc);
+	if (block_size < 0 || block_size > EVP_MAX_BLOCK_LENGTH)
+		goto err;
+
+	/* Determine explicit IV length. */
+	eiv_len = 0;
+	if (rl->version != TLS1_VERSION &&
+	    EVP_CIPHER_CTX_mode(enc) == EVP_CIPH_CBC_MODE)
+		eiv_len = EVP_CIPHER_CTX_iv_length(enc);
+	if (eiv_len < 0 || eiv_len > EVP_MAX_IV_LENGTH)
+		goto err;
+
+	mac_len = 0;
+	if (rl->read_hash_ctx != NULL) {
+		mac_len = EVP_MD_CTX_size(rl->read_hash_ctx);
+		if (mac_len <= 0 || mac_len > EVP_MAX_MD_SIZE)
+			goto err;
+	}
+
+	/* CBC has at least one padding byte. */
+	min_len = eiv_len + mac_len;
+	if (EVP_CIPHER_CTX_mode(enc) == EVP_CIPH_CBC_MODE)
+		min_len += 1;
+
+	if (CBS_len(fragment) < min_len) {
+		rl->alert_desc = SSL_AD_BAD_RECORD_MAC;
+		goto err;
+	}
+	if (CBS_len(fragment) > SSL3_RT_MAX_ENCRYPTED_LENGTH) {
+		rl->alert_desc = SSL_AD_RECORD_OVERFLOW;
+		goto err;
+	}
+	if (CBS_len(fragment) % block_size != 0) {
+		rl->alert_desc = SSL_AD_BAD_RECORD_MAC;
+		goto err;
+	}
+
+	/* XXX - decrypt/process in place for now. */
+	plain = (uint8_t *)CBS_data(fragment);
+	plain_len = CBS_len(fragment);
+
+	if (!EVP_Cipher(enc, plain, CBS_data(fragment), plain_len))
+		goto err;
+
+	rrec.data = plain;
+	rrec.input = plain;
+	rrec.length = plain_len;
+
+	/*
+	 * We now have to remove padding, extract MAC, calculate MAC
+	 * and compare MAC in constant time.
+	 */
+	if (block_size > 1)
+		ssl3_cbc_remove_padding(&rrec, eiv_len, mac_len);
+
+	if ((mac = calloc(1, mac_len)) == NULL)
+		goto err;
+
+	if (!CBB_init(&cbb_mac, EVP_MAX_MD_SIZE))
+		goto err;
+	if (EVP_CIPHER_CTX_mode(enc) == EVP_CIPH_CBC_MODE) {
+		ssl3_cbc_copy_mac(mac, &rrec, mac_len, rrec.length +
+		    rrec.padding_length);
+		rrec.length -= mac_len;
+		if (!tls12_record_layer_read_mac_cbc(rl, &cbb_mac, content_type,
+		    rrec.input, rrec.length, mac_len, rrec.padding_length))
+			goto err;
+	} else {
+		rrec.length -= mac_len;
+		memcpy(mac, rrec.data + rrec.length, mac_len);
+		if (!tls12_record_layer_read_mac(rl, &cbb_mac, content_type,
+		    rrec.input, rrec.length))
+			goto err;
+	}
+	if (!CBB_finish(&cbb_mac, &out_mac, &out_mac_len))
+		goto err;
+	if (mac_len != out_mac_len)
+		goto err;
+
+	if (timingsafe_memcmp(mac, out_mac, mac_len) != 0) {
+		rl->alert_desc = SSL_AD_BAD_RECORD_MAC;
+		goto err;
+	}
+
+	if (rrec.length > SSL3_RT_MAX_COMPRESSED_LENGTH + mac_len) {
+		rl->alert_desc = SSL_AD_BAD_RECORD_MAC;
+		goto err;
+	}
+	if (rrec.length > SSL3_RT_MAX_PLAIN_LENGTH) {
+		rl->alert_desc = SSL_AD_RECORD_OVERFLOW;
+		goto err;
+	}
+
+	*out = rrec.data;
+	*out_len = rrec.length;
+
+	ret = 1;
+
+ err:
+	CBB_cleanup(&cbb_mac);
+	freezero(mac, mac_len);
+	freezero(out_mac, out_mac_len);
+
+	return ret;
+}
+
+int
+tls12_record_layer_open_record(struct tls12_record_layer *rl, uint8_t *buf,
+    size_t buf_len, uint8_t **out, size_t *out_len)
+{
+	CBS cbs, fragment, seq_no;
+	uint16_t epoch, version;
+	uint8_t content_type;
+
+	CBS_init(&cbs, buf, buf_len);
+
+	if (!CBS_get_u8(&cbs, &content_type))
+		return 0;
+	if (!CBS_get_u16(&cbs, &version))
+		return 0;
+	if (rl->dtls) {
+		if (!CBS_get_u16(&cbs, &epoch))
+			return 0;
+		if (!CBS_get_bytes(&cbs, &seq_no, 6))
+			return 0;
+	}
+	if (!CBS_get_u16_length_prefixed(&cbs, &fragment))
+		return 0;
+
+	if (rl->read_aead_ctx != NULL) {
+		if (!tls12_record_layer_open_record_protected_aead(rl,
+		    content_type, &fragment, out, out_len))
+			return 0;
+	} else if (rl->read_cipher_ctx != NULL) {
+		if (!tls12_record_layer_open_record_protected_cipher(rl,
+		    content_type, &fragment, out, out_len))
+			return 0;
+	} else {
+		if (!tls12_record_layer_open_record_plaintext(rl,
+		    content_type, &fragment, out, out_len))
+			return 0;
+	}
+
+	if (!rl->dtls)
+		tls1_record_sequence_increment(rl->read_seq_num);
+
+	return 1;
+}
+
+static int
 tls12_record_layer_seal_record_plaintext(struct tls12_record_layer *rl,
     uint8_t content_type, const uint8_t *content, size_t content_len, CBB *out)
 {