1 /*
2 * Copyright 2022-2024 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <assert.h>
11 #include <openssl/bio.h>
12 #include <openssl/ssl.h>
13 #include <openssl/err.h>
14 #include <openssl/core_names.h>
15 #include <openssl/comp.h>
16 #include <openssl/ssl.h>
17 #include "internal/e_os.h"
18 #include "internal/packet.h"
19 #include "internal/ssl3_cbc.h"
20 #include "../../ssl_local.h"
21 #include "../record_local.h"
22 #include "recmethod_local.h"
23
24 static void tls_int_free(OSSL_RECORD_LAYER *rl);
25
ossl_tls_buffer_release(TLS_BUFFER * b)26 void ossl_tls_buffer_release(TLS_BUFFER *b)
27 {
28 OPENSSL_free(b->buf);
29 b->buf = NULL;
30 }
31
TLS_RL_RECORD_release(TLS_RL_RECORD * r,size_t num_recs)32 static void TLS_RL_RECORD_release(TLS_RL_RECORD *r, size_t num_recs)
33 {
34 size_t i;
35
36 for (i = 0; i < num_recs; i++) {
37 OPENSSL_free(r[i].comp);
38 r[i].comp = NULL;
39 }
40 }
41
ossl_tls_rl_record_set_seq_num(TLS_RL_RECORD * r,const unsigned char * seq_num)42 void ossl_tls_rl_record_set_seq_num(TLS_RL_RECORD *r,
43 const unsigned char *seq_num)
44 {
45 memcpy(r->seq_num, seq_num, SEQ_NUM_SIZE);
46 }
47
ossl_rlayer_fatal(OSSL_RECORD_LAYER * rl,int al,int reason,const char * fmt,...)48 void ossl_rlayer_fatal(OSSL_RECORD_LAYER *rl, int al, int reason,
49 const char *fmt, ...)
50 {
51 va_list args;
52
53 va_start(args, fmt);
54 ERR_vset_error(ERR_LIB_SSL, reason, fmt, args);
55 va_end(args);
56
57 rl->alert = al;
58 }
59
ossl_set_tls_provider_parameters(OSSL_RECORD_LAYER * rl,EVP_CIPHER_CTX * ctx,const EVP_CIPHER * ciph,const EVP_MD * md)60 int ossl_set_tls_provider_parameters(OSSL_RECORD_LAYER *rl,
61 EVP_CIPHER_CTX *ctx,
62 const EVP_CIPHER *ciph,
63 const EVP_MD *md)
64 {
65 /*
66 * Provided cipher, the TLS padding/MAC removal is performed provider
67 * side so we need to tell the ctx about our TLS version and mac size
68 */
69 OSSL_PARAM params[3], *pprm = params;
70 size_t macsize = 0;
71 int imacsize = -1;
72
73 if ((EVP_CIPHER_get_flags(ciph) & EVP_CIPH_FLAG_AEAD_CIPHER) == 0
74 && !rl->use_etm)
75 imacsize = EVP_MD_get_size(md);
76 if (imacsize > 0)
77 macsize = (size_t)imacsize;
78
79 *pprm++ = OSSL_PARAM_construct_int(OSSL_CIPHER_PARAM_TLS_VERSION,
80 &rl->version);
81 *pprm++ = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_TLS_MAC_SIZE,
82 &macsize);
83 *pprm = OSSL_PARAM_construct_end();
84
85 if (!EVP_CIPHER_CTX_set_params(ctx, params)) {
86 ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
87 return 0;
88 }
89
90 return 1;
91 }
92
93 /*
94 * ssl3_cbc_record_digest_supported returns 1 iff |ctx| uses a hash function
95 * which ssl3_cbc_digest_record supports.
96 */
ssl3_cbc_record_digest_supported(const EVP_MD_CTX * ctx)97 char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
98 {
99 switch (EVP_MD_CTX_get_type(ctx)) {
100 case NID_md5:
101 case NID_sha1:
102 case NID_sha224:
103 case NID_sha256:
104 case NID_sha384:
105 case NID_sha512:
106 return 1;
107 default:
108 return 0;
109 }
110 }
111
112 #ifndef OPENSSL_NO_COMP
tls_allow_compression(OSSL_RECORD_LAYER * rl)113 static int tls_allow_compression(OSSL_RECORD_LAYER *rl)
114 {
115 if (rl->options & SSL_OP_NO_COMPRESSION)
116 return 0;
117
118 return rl->security == NULL
119 || rl->security(rl->cbarg, SSL_SECOP_COMPRESSION, 0, 0, NULL);
120 }
121 #endif
122
tls_release_write_buffer_int(OSSL_RECORD_LAYER * rl,size_t start)123 static void tls_release_write_buffer_int(OSSL_RECORD_LAYER *rl, size_t start)
124 {
125 TLS_BUFFER *wb;
126 size_t pipes;
127
128 pipes = rl->numwpipes;
129
130 while (pipes > start) {
131 wb = &rl->wbuf[pipes - 1];
132
133 if (TLS_BUFFER_is_app_buffer(wb))
134 TLS_BUFFER_set_app_buffer(wb, 0);
135 else
136 OPENSSL_free(wb->buf);
137 wb->buf = NULL;
138 pipes--;
139 }
140 }
141
tls_setup_write_buffer(OSSL_RECORD_LAYER * rl,size_t numwpipes,size_t firstlen,size_t nextlen)142 int tls_setup_write_buffer(OSSL_RECORD_LAYER *rl, size_t numwpipes,
143 size_t firstlen, size_t nextlen)
144 {
145 unsigned char *p;
146 size_t maxalign = 0, headerlen;
147 TLS_BUFFER *wb;
148 size_t currpipe;
149 size_t defltlen = 0;
150 size_t contenttypelen = 0;
151
152 if (firstlen == 0 || (numwpipes > 1 && nextlen == 0)) {
153 if (rl->isdtls)
154 headerlen = DTLS1_RT_HEADER_LENGTH + 1;
155 else
156 headerlen = SSL3_RT_HEADER_LENGTH;
157
158 /* TLSv1.3 adds an extra content type byte after payload data */
159 if (rl->version == TLS1_3_VERSION)
160 contenttypelen = 1;
161
162 #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD != 0
163 maxalign = SSL3_ALIGN_PAYLOAD - 1;
164 #endif
165
166 defltlen = maxalign + headerlen + rl->eivlen + rl->max_frag_len
167 + contenttypelen + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD;
168 #ifndef OPENSSL_NO_COMP
169 if (tls_allow_compression(rl))
170 defltlen += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
171 #endif
172 /*
173 * We don't need to add eivlen here since empty fragments only occur
174 * when we don't have an explicit IV. The contenttype byte will also
175 * always be 0 in these protocol versions
176 */
177 if ((rl->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) == 0)
178 defltlen += headerlen + maxalign + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD;
179 }
180
181 wb = rl->wbuf;
182 for (currpipe = 0; currpipe < numwpipes; currpipe++) {
183 TLS_BUFFER *thiswb = &wb[currpipe];
184 size_t len = (currpipe == 0) ? firstlen : nextlen;
185
186 if (len == 0)
187 len = defltlen;
188
189 if (thiswb->len != len) {
190 OPENSSL_free(thiswb->buf);
191 thiswb->buf = NULL; /* force reallocation */
192 }
193
194 p = thiswb->buf;
195 if (p == NULL) {
196 p = OPENSSL_malloc(len);
197 if (p == NULL) {
198 if (rl->numwpipes < currpipe)
199 rl->numwpipes = currpipe;
200 /*
201 * We've got a malloc failure, and we're still initialising
202 * buffers. We assume we're so doomed that we won't even be able
203 * to send an alert.
204 */
205 RLAYERfatal(rl, SSL_AD_NO_ALERT, ERR_R_CRYPTO_LIB);
206 return 0;
207 }
208 }
209 memset(thiswb, 0, sizeof(TLS_BUFFER));
210 thiswb->buf = p;
211 thiswb->len = len;
212 }
213
214 /* Free any previously allocated buffers that we are no longer using */
215 tls_release_write_buffer_int(rl, currpipe);
216
217 rl->numwpipes = numwpipes;
218
219 return 1;
220 }
221
tls_release_write_buffer(OSSL_RECORD_LAYER * rl)222 static void tls_release_write_buffer(OSSL_RECORD_LAYER *rl)
223 {
224 tls_release_write_buffer_int(rl, 0);
225
226 rl->numwpipes = 0;
227 }
228
tls_setup_read_buffer(OSSL_RECORD_LAYER * rl)229 int tls_setup_read_buffer(OSSL_RECORD_LAYER *rl)
230 {
231 unsigned char *p;
232 size_t len, maxalign = 0, headerlen;
233 TLS_BUFFER *b;
234
235 b = &rl->rbuf;
236
237 if (rl->isdtls)
238 headerlen = DTLS1_RT_HEADER_LENGTH;
239 else
240 headerlen = SSL3_RT_HEADER_LENGTH;
241
242 #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD != 0
243 maxalign = SSL3_ALIGN_PAYLOAD - 1;
244 #endif
245
246 if (b->buf == NULL) {
247 len = rl->max_frag_len
248 + SSL3_RT_MAX_ENCRYPTED_OVERHEAD + headerlen + maxalign;
249 #ifndef OPENSSL_NO_COMP
250 if (tls_allow_compression(rl))
251 len += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
252 #endif
253
254 /* Ensure our buffer is large enough to support all our pipelines */
255 if (rl->max_pipelines > 1)
256 len *= rl->max_pipelines;
257
258 if (b->default_len > len)
259 len = b->default_len;
260
261 if ((p = OPENSSL_malloc(len)) == NULL) {
262 /*
263 * We've got a malloc failure, and we're still initialising buffers.
264 * We assume we're so doomed that we won't even be able to send an
265 * alert.
266 */
267 RLAYERfatal(rl, SSL_AD_NO_ALERT, ERR_R_CRYPTO_LIB);
268 return 0;
269 }
270 b->buf = p;
271 b->len = len;
272 }
273
274 return 1;
275 }
276
tls_release_read_buffer(OSSL_RECORD_LAYER * rl)277 static int tls_release_read_buffer(OSSL_RECORD_LAYER *rl)
278 {
279 TLS_BUFFER *b;
280
281 b = &rl->rbuf;
282 if ((rl->options & SSL_OP_CLEANSE_PLAINTEXT) != 0)
283 OPENSSL_cleanse(b->buf, b->len);
284 OPENSSL_free(b->buf);
285 b->buf = NULL;
286 rl->packet = NULL;
287 rl->packet_length = 0;
288 return 1;
289 }
290
291 /*
292 * Return values are as per SSL_read()
293 */
tls_default_read_n(OSSL_RECORD_LAYER * rl,size_t n,size_t max,int extend,int clearold,size_t * readbytes)294 int tls_default_read_n(OSSL_RECORD_LAYER *rl, size_t n, size_t max, int extend,
295 int clearold, size_t *readbytes)
296 {
297 /*
298 * If extend == 0, obtain new n-byte packet; if extend == 1, increase
299 * packet by another n bytes. The packet will be in the sub-array of
300 * rl->rbuf.buf specified by rl->packet and rl->packet_length. (If
301 * rl->read_ahead is set, 'max' bytes may be stored in rbuf [plus
302 * rl->packet_length bytes if extend == 1].) if clearold == 1, move the
303 * packet to the start of the buffer; if clearold == 0 then leave any old
304 * packets where they were
305 */
306 size_t len, left, align = 0;
307 unsigned char *pkt;
308 TLS_BUFFER *rb;
309
310 if (n == 0)
311 return OSSL_RECORD_RETURN_NON_FATAL_ERR;
312
313 rb = &rl->rbuf;
314 left = rb->left;
315 #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD != 0
316 align = (size_t)rb->buf + SSL3_RT_HEADER_LENGTH;
317 align = SSL3_ALIGN_PAYLOAD - 1 - ((align - 1) % SSL3_ALIGN_PAYLOAD);
318 #endif
319
320 if (!extend) {
321 /* start with empty packet ... */
322 if (left == 0)
323 rb->offset = align;
324
325 rl->packet = rb->buf + rb->offset;
326 rl->packet_length = 0;
327 /* ... now we can act as if 'extend' was set */
328 }
329
330 if (!ossl_assert(rl->packet != NULL)) {
331 /* does not happen */
332 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
333 return OSSL_RECORD_RETURN_FATAL;
334 }
335
336 len = rl->packet_length;
337 pkt = rb->buf + align;
338 /*
339 * Move any available bytes to front of buffer: 'len' bytes already
340 * pointed to by 'packet', 'left' extra ones at the end
341 */
342 if (rl->packet != pkt && clearold == 1) {
343 memmove(pkt, rl->packet, len + left);
344 rl->packet = pkt;
345 rb->offset = len + align;
346 }
347
348 /*
349 * For DTLS/UDP reads should not span multiple packets because the read
350 * operation returns the whole packet at once (as long as it fits into
351 * the buffer).
352 */
353 if (rl->isdtls) {
354 if (left == 0 && extend) {
355 /*
356 * We received a record with a header but no body data. This will
357 * get dumped.
358 */
359 return OSSL_RECORD_RETURN_NON_FATAL_ERR;
360 }
361 if (left > 0 && n > left)
362 n = left;
363 }
364
365 /* if there is enough in the buffer from a previous read, take some */
366 if (left >= n) {
367 rl->packet_length += n;
368 rb->left = left - n;
369 rb->offset += n;
370 *readbytes = n;
371 return OSSL_RECORD_RETURN_SUCCESS;
372 }
373
374 /* else we need to read more data */
375
376 if (n > rb->len - rb->offset) {
377 /* does not happen */
378 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
379 return OSSL_RECORD_RETURN_FATAL;
380 }
381
382 /* We always act like read_ahead is set for DTLS */
383 if (!rl->read_ahead && !rl->isdtls) {
384 /* ignore max parameter */
385 max = n;
386 } else {
387 if (max < n)
388 max = n;
389 if (max > rb->len - rb->offset)
390 max = rb->len - rb->offset;
391 }
392
393 while (left < n) {
394 size_t bioread = 0;
395 int ret;
396 BIO *bio = rl->prev != NULL ? rl->prev : rl->bio;
397
398 /*
399 * Now we have len+left bytes at the front of rl->rbuf.buf and
400 * need to read in more until we have len + n (up to len + max if
401 * possible)
402 */
403
404 clear_sys_error();
405 if (bio != NULL) {
406 ret = BIO_read(bio, pkt + len + left, max - left);
407 if (ret > 0) {
408 bioread = ret;
409 ret = OSSL_RECORD_RETURN_SUCCESS;
410 } else if (BIO_should_retry(bio)) {
411 if (rl->prev != NULL) {
412 /*
413 * We were reading from the previous epoch. Now there is no
414 * more data, so swap to the actual transport BIO
415 */
416 BIO_free(rl->prev);
417 rl->prev = NULL;
418 continue;
419 }
420 ret = OSSL_RECORD_RETURN_RETRY;
421 } else if (BIO_eof(bio)) {
422 ret = OSSL_RECORD_RETURN_EOF;
423 } else {
424 ret = OSSL_RECORD_RETURN_FATAL;
425 }
426 } else {
427 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, SSL_R_READ_BIO_NOT_SET);
428 ret = OSSL_RECORD_RETURN_FATAL;
429 }
430
431 if (ret <= OSSL_RECORD_RETURN_RETRY) {
432 rb->left = left;
433 if ((rl->mode & SSL_MODE_RELEASE_BUFFERS) != 0 && !rl->isdtls)
434 if (len + left == 0)
435 tls_release_read_buffer(rl);
436 return ret;
437 }
438 left += bioread;
439 /*
440 * reads should *never* span multiple packets for DTLS because the
441 * underlying transport protocol is message oriented as opposed to
442 * byte oriented as in the TLS case.
443 */
444 if (rl->isdtls) {
445 if (n > left)
446 n = left; /* makes the while condition false */
447 }
448 }
449
450 /* done reading, now the book-keeping */
451 rb->offset += n;
452 rb->left = left - n;
453 rl->packet_length += n;
454 *readbytes = n;
455 return OSSL_RECORD_RETURN_SUCCESS;
456 }
457
458 /*
459 * Peeks ahead into "read_ahead" data to see if we have a whole record waiting
460 * for us in the buffer.
461 */
tls_record_app_data_waiting(OSSL_RECORD_LAYER * rl)462 static int tls_record_app_data_waiting(OSSL_RECORD_LAYER *rl)
463 {
464 TLS_BUFFER *rbuf;
465 size_t left, len;
466 unsigned char *p;
467
468 rbuf = &rl->rbuf;
469
470 p = TLS_BUFFER_get_buf(rbuf);
471 if (p == NULL)
472 return 0;
473
474 left = TLS_BUFFER_get_left(rbuf);
475
476 if (left < SSL3_RT_HEADER_LENGTH)
477 return 0;
478
479 p += TLS_BUFFER_get_offset(rbuf);
480
481 /*
482 * We only check the type and record length, we will sanity check version
483 * etc later
484 */
485 if (*p != SSL3_RT_APPLICATION_DATA)
486 return 0;
487
488 p += 3;
489 n2s(p, len);
490
491 if (left < SSL3_RT_HEADER_LENGTH + len)
492 return 0;
493
494 return 1;
495 }
496
rlayer_early_data_count_ok(OSSL_RECORD_LAYER * rl,size_t length,size_t overhead,int send)497 static int rlayer_early_data_count_ok(OSSL_RECORD_LAYER *rl, size_t length,
498 size_t overhead, int send)
499 {
500 uint32_t max_early_data = rl->max_early_data;
501
502 if (max_early_data == 0) {
503 RLAYERfatal(rl, send ? SSL_AD_INTERNAL_ERROR : SSL_AD_UNEXPECTED_MESSAGE,
504 SSL_R_TOO_MUCH_EARLY_DATA);
505 return 0;
506 }
507
508 /* If we are dealing with ciphertext we need to allow for the overhead */
509 max_early_data += overhead;
510
511 if (rl->early_data_count + length > max_early_data) {
512 RLAYERfatal(rl, send ? SSL_AD_INTERNAL_ERROR : SSL_AD_UNEXPECTED_MESSAGE,
513 SSL_R_TOO_MUCH_EARLY_DATA);
514 return 0;
515 }
516 rl->early_data_count += length;
517
518 return 1;
519 }
520
521 /*
522 * MAX_EMPTY_RECORDS defines the number of consecutive, empty records that
523 * will be processed per call to tls_get_more_records. Without this limit an
524 * attacker could send empty records at a faster rate than we can process and
525 * cause tls_get_more_records to loop forever.
526 */
527 #define MAX_EMPTY_RECORDS 32
528
529 #define SSL2_RT_HEADER_LENGTH 2
530
531 /*-
532 * Call this to buffer new input records in rl->rrec.
533 * It will return a OSSL_RECORD_RETURN_* value.
534 * When it finishes successfully (OSSL_RECORD_RETURN_SUCCESS), |rl->num_recs|
535 * records have been decoded. For each record 'i':
536 * rrec[i].type - is the type of record
537 * rrec[i].data, - data
538 * rrec[i].length, - number of bytes
539 * Multiple records will only be returned if the record types are all
540 * SSL3_RT_APPLICATION_DATA. The number of records returned will always be <=
541 * |max_pipelines|
542 */
tls_get_more_records(OSSL_RECORD_LAYER * rl)543 int tls_get_more_records(OSSL_RECORD_LAYER *rl)
544 {
545 int enc_err, rret;
546 int i;
547 size_t more, n;
548 TLS_RL_RECORD *rr, *thisrr;
549 TLS_BUFFER *rbuf;
550 unsigned char *p;
551 unsigned char md[EVP_MAX_MD_SIZE];
552 unsigned int version;
553 size_t mac_size = 0;
554 int imac_size;
555 size_t num_recs = 0, max_recs, j;
556 PACKET pkt, sslv2pkt;
557 SSL_MAC_BUF *macbufs = NULL;
558 int ret = OSSL_RECORD_RETURN_FATAL;
559
560 rr = rl->rrec;
561 rbuf = &rl->rbuf;
562 if (rbuf->buf == NULL) {
563 if (!tls_setup_read_buffer(rl)) {
564 /* RLAYERfatal() already called */
565 return OSSL_RECORD_RETURN_FATAL;
566 }
567 }
568
569 max_recs = rl->max_pipelines;
570
571 if (max_recs == 0)
572 max_recs = 1;
573
574 do {
575 thisrr = &rr[num_recs];
576
577 /* check if we have the header */
578 if ((rl->rstate != SSL_ST_READ_BODY) ||
579 (rl->packet_length < SSL3_RT_HEADER_LENGTH)) {
580 size_t sslv2len;
581 unsigned int type;
582
583 rret = rl->funcs->read_n(rl, SSL3_RT_HEADER_LENGTH,
584 TLS_BUFFER_get_len(rbuf), 0,
585 num_recs == 0 ? 1 : 0, &n);
586
587 if (rret < OSSL_RECORD_RETURN_SUCCESS)
588 return rret; /* error or non-blocking */
589
590 rl->rstate = SSL_ST_READ_BODY;
591
592 p = rl->packet;
593 if (!PACKET_buf_init(&pkt, p, rl->packet_length)) {
594 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
595 return OSSL_RECORD_RETURN_FATAL;
596 }
597 sslv2pkt = pkt;
598 if (!PACKET_get_net_2_len(&sslv2pkt, &sslv2len)
599 || !PACKET_get_1(&sslv2pkt, &type)) {
600 RLAYERfatal(rl, SSL_AD_DECODE_ERROR, ERR_R_INTERNAL_ERROR);
601 return OSSL_RECORD_RETURN_FATAL;
602 }
603 /*
604 * The first record received by the server may be a V2ClientHello.
605 */
606 if (rl->role == OSSL_RECORD_ROLE_SERVER
607 && rl->is_first_record
608 && (sslv2len & 0x8000) != 0
609 && (type == SSL2_MT_CLIENT_HELLO)) {
610 /*
611 * SSLv2 style record
612 *
613 * |num_recs| here will actually always be 0 because
614 * |num_recs > 0| only ever occurs when we are processing
615 * multiple app data records - which we know isn't the case here
616 * because it is an SSLv2ClientHello. We keep it using
617 * |num_recs| for the sake of consistency
618 */
619 thisrr->type = SSL3_RT_HANDSHAKE;
620 thisrr->rec_version = SSL2_VERSION;
621
622 thisrr->length = sslv2len & 0x7fff;
623
624 if (thisrr->length > TLS_BUFFER_get_len(rbuf)
625 - SSL2_RT_HEADER_LENGTH) {
626 RLAYERfatal(rl, SSL_AD_RECORD_OVERFLOW,
627 SSL_R_PACKET_LENGTH_TOO_LONG);
628 return OSSL_RECORD_RETURN_FATAL;
629 }
630 } else {
631 /* SSLv3+ style record */
632
633 /* Pull apart the header into the TLS_RL_RECORD */
634 if (!PACKET_get_1(&pkt, &type)
635 || !PACKET_get_net_2(&pkt, &version)
636 || !PACKET_get_net_2_len(&pkt, &thisrr->length)) {
637 if (rl->msg_callback != NULL)
638 rl->msg_callback(0, 0, SSL3_RT_HEADER, p, 5, rl->cbarg);
639 RLAYERfatal(rl, SSL_AD_DECODE_ERROR, ERR_R_INTERNAL_ERROR);
640 return OSSL_RECORD_RETURN_FATAL;
641 }
642 thisrr->type = type;
643 thisrr->rec_version = version;
644
645 /*
646 * When we call validate_record_header() only records actually
647 * received in SSLv2 format should have the record version set
648 * to SSL2_VERSION. This way validate_record_header() can know
649 * what format the record was in based on the version.
650 */
651 if (thisrr->rec_version == SSL2_VERSION) {
652 RLAYERfatal(rl, SSL_AD_PROTOCOL_VERSION,
653 SSL_R_WRONG_VERSION_NUMBER);
654 return OSSL_RECORD_RETURN_FATAL;
655 }
656
657 if (rl->msg_callback != NULL)
658 rl->msg_callback(0, version, SSL3_RT_HEADER, p, 5, rl->cbarg);
659
660 if (thisrr->length >
661 TLS_BUFFER_get_len(rbuf) - SSL3_RT_HEADER_LENGTH) {
662 RLAYERfatal(rl, SSL_AD_RECORD_OVERFLOW,
663 SSL_R_PACKET_LENGTH_TOO_LONG);
664 return OSSL_RECORD_RETURN_FATAL;
665 }
666 }
667
668 if (!rl->funcs->validate_record_header(rl, thisrr)) {
669 /* RLAYERfatal already called */
670 return OSSL_RECORD_RETURN_FATAL;
671 }
672
673 /* now rl->rstate == SSL_ST_READ_BODY */
674 }
675
676 /*
677 * rl->rstate == SSL_ST_READ_BODY, get and decode the data. Calculate
678 * how much more data we need to read for the rest of the record
679 */
680 if (thisrr->rec_version == SSL2_VERSION) {
681 more = thisrr->length + SSL2_RT_HEADER_LENGTH
682 - SSL3_RT_HEADER_LENGTH;
683 } else {
684 more = thisrr->length;
685 }
686
687 if (more > 0) {
688 /* now rl->packet_length == SSL3_RT_HEADER_LENGTH */
689
690 rret = rl->funcs->read_n(rl, more, more, 1, 0, &n);
691 if (rret < OSSL_RECORD_RETURN_SUCCESS)
692 return rret; /* error or non-blocking io */
693 }
694
695 /* set state for later operations */
696 rl->rstate = SSL_ST_READ_HEADER;
697
698 /*
699 * At this point, rl->packet_length == SSL3_RT_HEADER_LENGTH
700 * + thisrr->length, or rl->packet_length == SSL2_RT_HEADER_LENGTH
701 * + thisrr->length and we have that many bytes in rl->packet
702 */
703 if (thisrr->rec_version == SSL2_VERSION)
704 thisrr->input = &(rl->packet[SSL2_RT_HEADER_LENGTH]);
705 else
706 thisrr->input = &(rl->packet[SSL3_RT_HEADER_LENGTH]);
707
708 /*
709 * ok, we can now read from 'rl->packet' data into 'thisrr'.
710 * thisrr->input points at thisrr->length bytes, which need to be copied
711 * into thisrr->data by either the decryption or by the decompression.
712 * When the data is 'copied' into the thisrr->data buffer,
713 * thisrr->input will be updated to point at the new buffer
714 */
715
716 /*
717 * We now have - encrypted [ MAC [ compressed [ plain ] ] ]
718 * thisrr->length bytes of encrypted compressed stuff.
719 */
720
721 /* decrypt in place in 'thisrr->input' */
722 thisrr->data = thisrr->input;
723 thisrr->orig_len = thisrr->length;
724
725 num_recs++;
726
727 /* we have pulled in a full packet so zero things */
728 rl->packet_length = 0;
729 rl->is_first_record = 0;
730 } while (num_recs < max_recs
731 && thisrr->type == SSL3_RT_APPLICATION_DATA
732 && RLAYER_USE_EXPLICIT_IV(rl)
733 && rl->enc_ctx != NULL
734 && (EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(rl->enc_ctx))
735 & EVP_CIPH_FLAG_PIPELINE) != 0
736 && tls_record_app_data_waiting(rl));
737
738 if (num_recs == 1
739 && thisrr->type == SSL3_RT_CHANGE_CIPHER_SPEC
740 /* The following can happen in tlsany_meth after HRR */
741 && rl->version == TLS1_3_VERSION
742 && rl->is_first_handshake) {
743 /*
744 * CCS messages must be exactly 1 byte long, containing the value 0x01
745 */
746 if (thisrr->length != 1 || thisrr->data[0] != 0x01) {
747 RLAYERfatal(rl, SSL_AD_UNEXPECTED_MESSAGE,
748 SSL_R_INVALID_CCS_MESSAGE);
749 return OSSL_RECORD_RETURN_FATAL;
750 }
751 /*
752 * CCS messages are ignored in TLSv1.3. We treat it like an empty
753 * handshake record - but we still call the msg_callback
754 */
755 if (rl->msg_callback != NULL)
756 rl->msg_callback(0, TLS1_3_VERSION, SSL3_RT_CHANGE_CIPHER_SPEC,
757 thisrr->data, 1, rl->cbarg);
758 thisrr->type = SSL3_RT_HANDSHAKE;
759 if (++(rl->empty_record_count) > MAX_EMPTY_RECORDS) {
760 RLAYERfatal(rl, SSL_AD_UNEXPECTED_MESSAGE,
761 SSL_R_UNEXPECTED_CCS_MESSAGE);
762 return OSSL_RECORD_RETURN_FATAL;
763 }
764 rl->num_recs = 0;
765 rl->curr_rec = 0;
766 rl->num_released = 0;
767
768 return OSSL_RECORD_RETURN_SUCCESS;
769 }
770
771 if (rl->md_ctx != NULL) {
772 const EVP_MD *tmpmd = EVP_MD_CTX_get0_md(rl->md_ctx);
773
774 if (tmpmd != NULL) {
775 imac_size = EVP_MD_get_size(tmpmd);
776 if (!ossl_assert(imac_size > 0 && imac_size <= EVP_MAX_MD_SIZE)) {
777 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
778 return OSSL_RECORD_RETURN_FATAL;
779 }
780 mac_size = (size_t)imac_size;
781 }
782 }
783
784 /*
785 * If in encrypt-then-mac mode calculate mac from encrypted record. All
786 * the details below are public so no timing details can leak.
787 */
788 if (rl->use_etm && rl->md_ctx != NULL) {
789 unsigned char *mac;
790
791 for (j = 0; j < num_recs; j++) {
792 thisrr = &rr[j];
793
794 if (thisrr->length < mac_size) {
795 RLAYERfatal(rl, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_TOO_SHORT);
796 return OSSL_RECORD_RETURN_FATAL;
797 }
798 thisrr->length -= mac_size;
799 mac = thisrr->data + thisrr->length;
800 i = rl->funcs->mac(rl, thisrr, md, 0 /* not send */);
801 if (i == 0 || CRYPTO_memcmp(md, mac, mac_size) != 0) {
802 RLAYERfatal(rl, SSL_AD_BAD_RECORD_MAC,
803 SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
804 return OSSL_RECORD_RETURN_FATAL;
805 }
806 }
807 /*
808 * We've handled the mac now - there is no MAC inside the encrypted
809 * record
810 */
811 mac_size = 0;
812 }
813
814 if (mac_size > 0) {
815 macbufs = OPENSSL_zalloc(sizeof(*macbufs) * num_recs);
816 if (macbufs == NULL) {
817 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
818 return OSSL_RECORD_RETURN_FATAL;
819 }
820 }
821
822 ERR_set_mark();
823 enc_err = rl->funcs->cipher(rl, rr, num_recs, 0, macbufs, mac_size);
824
825 /*-
826 * enc_err is:
827 * 0: if the record is publicly invalid, or an internal error, or AEAD
828 * decryption failed, or ETM decryption failed.
829 * 1: Success or MTE decryption failed (MAC will be randomised)
830 */
831 if (enc_err == 0) {
832 if (rl->alert != SSL_AD_NO_ALERT) {
833 /* RLAYERfatal() already got called */
834 ERR_clear_last_mark();
835 goto end;
836 }
837 if (num_recs == 1
838 && rl->skip_early_data != NULL
839 && rl->skip_early_data(rl->cbarg)) {
840 /*
841 * Valid early_data that we cannot decrypt will fail here. We treat
842 * it like an empty record.
843 */
844
845 /*
846 * Remove any errors from the stack. Decryption failures are normal
847 * behaviour.
848 */
849 ERR_pop_to_mark();
850
851 thisrr = &rr[0];
852
853 if (!rlayer_early_data_count_ok(rl, thisrr->length,
854 EARLY_DATA_CIPHERTEXT_OVERHEAD, 0)) {
855 /* RLAYERfatal() already called */
856 goto end;
857 }
858
859 thisrr->length = 0;
860 rl->num_recs = 0;
861 rl->curr_rec = 0;
862 rl->num_released = 0;
863 /* Reset the read sequence */
864 memset(rl->sequence, 0, sizeof(rl->sequence));
865 ret = 1;
866 goto end;
867 }
868 ERR_clear_last_mark();
869 RLAYERfatal(rl, SSL_AD_BAD_RECORD_MAC,
870 SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
871 goto end;
872 } else {
873 ERR_clear_last_mark();
874 }
875 OSSL_TRACE_BEGIN(TLS) {
876 BIO_printf(trc_out, "dec %lu\n", (unsigned long)rr[0].length);
877 BIO_dump_indent(trc_out, rr[0].data, rr[0].length, 4);
878 } OSSL_TRACE_END(TLS);
879
880 /* r->length is now the compressed data plus mac */
881 if (rl->enc_ctx != NULL
882 && !rl->use_etm
883 && EVP_MD_CTX_get0_md(rl->md_ctx) != NULL) {
884 for (j = 0; j < num_recs; j++) {
885 SSL_MAC_BUF *thismb = &macbufs[j];
886
887 thisrr = &rr[j];
888
889 i = rl->funcs->mac(rl, thisrr, md, 0 /* not send */);
890 if (i == 0 || thismb == NULL || thismb->mac == NULL
891 || CRYPTO_memcmp(md, thismb->mac, (size_t)mac_size) != 0)
892 enc_err = 0;
893 if (thisrr->length > SSL3_RT_MAX_COMPRESSED_LENGTH + mac_size)
894 enc_err = 0;
895 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
896 if (enc_err == 0 && mac_size > 0 && thismb != NULL &&
897 thismb->mac != NULL && (md[0] ^ thismb->mac[0]) != 0xFF) {
898 enc_err = 1;
899 }
900 #endif
901 }
902 }
903
904 if (enc_err == 0) {
905 if (rl->alert != SSL_AD_NO_ALERT) {
906 /* We already called RLAYERfatal() */
907 goto end;
908 }
909 /*
910 * A separate 'decryption_failed' alert was introduced with TLS 1.0,
911 * SSL 3.0 only has 'bad_record_mac'. But unless a decryption
912 * failure is directly visible from the ciphertext anyway, we should
913 * not reveal which kind of error occurred -- this might become
914 * visible to an attacker (e.g. via a logfile)
915 */
916 RLAYERfatal(rl, SSL_AD_BAD_RECORD_MAC,
917 SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
918 goto end;
919 }
920
921 for (j = 0; j < num_recs; j++) {
922 thisrr = &rr[j];
923
924 if (!rl->funcs->post_process_record(rl, thisrr)) {
925 /* RLAYERfatal already called */
926 goto end;
927 }
928
929 /*
930 * Record overflow checking (e.g. checking if
931 * thisrr->length > SSL3_RT_MAX_PLAIN_LENGTH) is the responsibility of
932 * the post_process_record() function above. However we check here if
933 * the received packet overflows the current Max Fragment Length setting
934 * if there is one.
935 * Note: rl->max_frag_len != SSL3_RT_MAX_PLAIN_LENGTH and KTLS are
936 * mutually exclusive. Also note that with KTLS thisrr->length can
937 * be > SSL3_RT_MAX_PLAIN_LENGTH (and rl->max_frag_len must be ignored)
938 */
939 if (rl->max_frag_len != SSL3_RT_MAX_PLAIN_LENGTH
940 && thisrr->length > rl->max_frag_len) {
941 RLAYERfatal(rl, SSL_AD_RECORD_OVERFLOW, SSL_R_DATA_LENGTH_TOO_LONG);
942 goto end;
943 }
944
945 thisrr->off = 0;
946 /*-
947 * So at this point the following is true
948 * thisrr->type is the type of record
949 * thisrr->length == number of bytes in record
950 * thisrr->off == offset to first valid byte
951 * thisrr->data == where to take bytes from, increment after use :-).
952 */
953
954 /* just read a 0 length packet */
955 if (thisrr->length == 0) {
956 if (++(rl->empty_record_count) > MAX_EMPTY_RECORDS) {
957 RLAYERfatal(rl, SSL_AD_UNEXPECTED_MESSAGE,
958 SSL_R_RECORD_TOO_SMALL);
959 goto end;
960 }
961 } else {
962 rl->empty_record_count = 0;
963 }
964 }
965
966 if (rl->level == OSSL_RECORD_PROTECTION_LEVEL_EARLY) {
967 thisrr = &rr[0];
968 if (thisrr->type == SSL3_RT_APPLICATION_DATA
969 && !rlayer_early_data_count_ok(rl, thisrr->length, 0, 0)) {
970 /* RLAYERfatal already called */
971 goto end;
972 }
973 }
974
975 rl->num_recs = num_recs;
976 rl->curr_rec = 0;
977 rl->num_released = 0;
978 ret = OSSL_RECORD_RETURN_SUCCESS;
979 end:
980 if (macbufs != NULL) {
981 for (j = 0; j < num_recs; j++) {
982 if (macbufs[j].alloced)
983 OPENSSL_free(macbufs[j].mac);
984 }
985 OPENSSL_free(macbufs);
986 }
987 return ret;
988 }
989
990 /* Shared by ssl3_meth and tls1_meth */
tls_default_validate_record_header(OSSL_RECORD_LAYER * rl,TLS_RL_RECORD * rec)991 int tls_default_validate_record_header(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *rec)
992 {
993 size_t len = SSL3_RT_MAX_ENCRYPTED_LENGTH;
994
995 if (rec->rec_version != rl->version) {
996 RLAYERfatal(rl, SSL_AD_PROTOCOL_VERSION, SSL_R_WRONG_VERSION_NUMBER);
997 return 0;
998 }
999
1000 #ifndef OPENSSL_NO_COMP
1001 /*
1002 * If OPENSSL_NO_COMP is defined then SSL3_RT_MAX_ENCRYPTED_LENGTH
1003 * does not include the compression overhead anyway.
1004 */
1005 if (rl->compctx == NULL)
1006 len -= SSL3_RT_MAX_COMPRESSED_OVERHEAD;
1007 #endif
1008
1009 if (rec->length > len) {
1010 RLAYERfatal(rl, SSL_AD_RECORD_OVERFLOW,
1011 SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
1012 return 0;
1013 }
1014
1015 return 1;
1016 }
1017
tls_do_compress(OSSL_RECORD_LAYER * rl,TLS_RL_RECORD * wr)1018 int tls_do_compress(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *wr)
1019 {
1020 #ifndef OPENSSL_NO_COMP
1021 int i;
1022
1023 i = COMP_compress_block(rl->compctx, wr->data,
1024 (int)(wr->length + SSL3_RT_MAX_COMPRESSED_OVERHEAD),
1025 wr->input, (int)wr->length);
1026 if (i < 0)
1027 return 0;
1028
1029 wr->length = i;
1030 wr->input = wr->data;
1031 return 1;
1032 #else
1033 return 0;
1034 #endif
1035 }
1036
tls_do_uncompress(OSSL_RECORD_LAYER * rl,TLS_RL_RECORD * rec)1037 int tls_do_uncompress(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *rec)
1038 {
1039 #ifndef OPENSSL_NO_COMP
1040 int i;
1041
1042 if (rec->comp == NULL) {
1043 rec->comp = (unsigned char *)
1044 OPENSSL_malloc(SSL3_RT_MAX_ENCRYPTED_LENGTH);
1045 }
1046 if (rec->comp == NULL)
1047 return 0;
1048
1049 i = COMP_expand_block(rl->compctx, rec->comp, SSL3_RT_MAX_PLAIN_LENGTH,
1050 rec->data, (int)rec->length);
1051 if (i < 0)
1052 return 0;
1053 else
1054 rec->length = i;
1055 rec->data = rec->comp;
1056 return 1;
1057 #else
1058 return 0;
1059 #endif
1060 }
1061
1062 /* Shared by tlsany_meth, ssl3_meth and tls1_meth */
tls_default_post_process_record(OSSL_RECORD_LAYER * rl,TLS_RL_RECORD * rec)1063 int tls_default_post_process_record(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *rec)
1064 {
1065 if (rl->compctx != NULL) {
1066 if (rec->length > SSL3_RT_MAX_COMPRESSED_LENGTH) {
1067 RLAYERfatal(rl, SSL_AD_RECORD_OVERFLOW,
1068 SSL_R_COMPRESSED_LENGTH_TOO_LONG);
1069 return 0;
1070 }
1071 if (!tls_do_uncompress(rl, rec)) {
1072 RLAYERfatal(rl, SSL_AD_DECOMPRESSION_FAILURE,
1073 SSL_R_BAD_DECOMPRESSION);
1074 return 0;
1075 }
1076 }
1077
1078 if (rec->length > SSL3_RT_MAX_PLAIN_LENGTH) {
1079 RLAYERfatal(rl, SSL_AD_RECORD_OVERFLOW, SSL_R_DATA_LENGTH_TOO_LONG);
1080 return 0;
1081 }
1082
1083 return 1;
1084 }
1085
1086 /* Shared by tls13_meth and ktls_meth */
tls13_common_post_process_record(OSSL_RECORD_LAYER * rl,TLS_RL_RECORD * rec)1087 int tls13_common_post_process_record(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *rec)
1088 {
1089 if (rec->type != SSL3_RT_APPLICATION_DATA
1090 && rec->type != SSL3_RT_ALERT
1091 && rec->type != SSL3_RT_HANDSHAKE) {
1092 RLAYERfatal(rl, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_BAD_RECORD_TYPE);
1093 return 0;
1094 }
1095
1096 if (rl->msg_callback != NULL)
1097 rl->msg_callback(0, rl->version, SSL3_RT_INNER_CONTENT_TYPE, &rec->type,
1098 1, rl->cbarg);
1099
1100 /*
1101 * TLSv1.3 alert and handshake records are required to be non-zero in
1102 * length.
1103 */
1104 if ((rec->type == SSL3_RT_HANDSHAKE || rec->type == SSL3_RT_ALERT)
1105 && rec->length == 0) {
1106 RLAYERfatal(rl, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_BAD_LENGTH);
1107 return 0;
1108 }
1109
1110 return 1;
1111 }
1112
tls_read_record(OSSL_RECORD_LAYER * rl,void ** rechandle,int * rversion,uint8_t * type,const unsigned char ** data,size_t * datalen,uint16_t * epoch,unsigned char * seq_num)1113 int tls_read_record(OSSL_RECORD_LAYER *rl, void **rechandle, int *rversion,
1114 uint8_t *type, const unsigned char **data, size_t *datalen,
1115 uint16_t *epoch, unsigned char *seq_num)
1116 {
1117 TLS_RL_RECORD *rec;
1118
1119 /*
1120 * tls_get_more_records() can return success without actually reading
1121 * anything useful (i.e. if empty records are read). We loop here until
1122 * we have something useful. tls_get_more_records() will eventually fail if
1123 * too many sequential empty records are read.
1124 */
1125 while (rl->curr_rec >= rl->num_recs) {
1126 int ret;
1127
1128 if (rl->num_released != rl->num_recs) {
1129 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, SSL_R_RECORDS_NOT_RELEASED);
1130 return OSSL_RECORD_RETURN_FATAL;
1131 }
1132
1133 ret = rl->funcs->get_more_records(rl);
1134
1135 if (ret != OSSL_RECORD_RETURN_SUCCESS)
1136 return ret;
1137 }
1138
1139 /*
1140 * We have now got rl->num_recs records buffered in rl->rrec. rl->curr_rec
1141 * points to the next one to read.
1142 */
1143 rec = &rl->rrec[rl->curr_rec++];
1144
1145 *rechandle = rec;
1146 *rversion = rec->rec_version;
1147 *type = rec->type;
1148 *data = rec->data + rec->off;
1149 *datalen = rec->length;
1150 if (rl->isdtls) {
1151 *epoch = rec->epoch;
1152 memcpy(seq_num, rec->seq_num, sizeof(rec->seq_num));
1153 }
1154
1155 return OSSL_RECORD_RETURN_SUCCESS;
1156 }
1157
tls_release_record(OSSL_RECORD_LAYER * rl,void * rechandle,size_t length)1158 int tls_release_record(OSSL_RECORD_LAYER *rl, void *rechandle, size_t length)
1159 {
1160 TLS_RL_RECORD *rec = &rl->rrec[rl->num_released];
1161
1162 if (!ossl_assert(rl->num_released < rl->curr_rec)
1163 || !ossl_assert(rechandle == rec)) {
1164 /* Should not happen */
1165 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, SSL_R_INVALID_RECORD);
1166 return OSSL_RECORD_RETURN_FATAL;
1167 }
1168
1169 if (rec->length < length) {
1170 /* Should not happen */
1171 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1172 return OSSL_RECORD_RETURN_FATAL;
1173 }
1174
1175 if ((rl->options & SSL_OP_CLEANSE_PLAINTEXT) != 0)
1176 OPENSSL_cleanse(rec->data + rec->off, length);
1177
1178 rec->off += length;
1179 rec->length -= length;
1180
1181 if (rec->length > 0)
1182 return OSSL_RECORD_RETURN_SUCCESS;
1183
1184 rl->num_released++;
1185
1186 if (rl->curr_rec == rl->num_released
1187 && (rl->mode & SSL_MODE_RELEASE_BUFFERS) != 0
1188 && TLS_BUFFER_get_left(&rl->rbuf) == 0)
1189 tls_release_read_buffer(rl);
1190
1191 return OSSL_RECORD_RETURN_SUCCESS;
1192 }
1193
tls_set_options(OSSL_RECORD_LAYER * rl,const OSSL_PARAM * options)1194 int tls_set_options(OSSL_RECORD_LAYER *rl, const OSSL_PARAM *options)
1195 {
1196 const OSSL_PARAM *p;
1197
1198 p = OSSL_PARAM_locate_const(options, OSSL_LIBSSL_RECORD_LAYER_PARAM_OPTIONS);
1199 if (p != NULL && !OSSL_PARAM_get_uint64(p, &rl->options)) {
1200 ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
1201 return 0;
1202 }
1203
1204 p = OSSL_PARAM_locate_const(options, OSSL_LIBSSL_RECORD_LAYER_PARAM_MODE);
1205 if (p != NULL && !OSSL_PARAM_get_uint32(p, &rl->mode)) {
1206 ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
1207 return 0;
1208 }
1209
1210 if (rl->direction == OSSL_RECORD_DIRECTION_READ) {
1211 p = OSSL_PARAM_locate_const(options,
1212 OSSL_LIBSSL_RECORD_LAYER_READ_BUFFER_LEN);
1213 if (p != NULL && !OSSL_PARAM_get_size_t(p, &rl->rbuf.default_len)) {
1214 ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
1215 return 0;
1216 }
1217 } else {
1218 p = OSSL_PARAM_locate_const(options,
1219 OSSL_LIBSSL_RECORD_LAYER_PARAM_BLOCK_PADDING);
1220 if (p != NULL && !OSSL_PARAM_get_size_t(p, &rl->block_padding)) {
1221 ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
1222 return 0;
1223 }
1224 p = OSSL_PARAM_locate_const(options,
1225 OSSL_LIBSSL_RECORD_LAYER_PARAM_HS_PADDING);
1226 if (p != NULL && !OSSL_PARAM_get_size_t(p, &rl->hs_padding)) {
1227 ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
1228 return 0;
1229 }
1230 }
1231
1232 if (rl->level == OSSL_RECORD_PROTECTION_LEVEL_APPLICATION) {
1233 /*
1234 * We ignore any read_ahead setting prior to the application protection
1235 * level. Otherwise we may read ahead data in a lower protection level
1236 * that is destined for a higher protection level. To simplify the logic
1237 * we don't support that at this stage.
1238 */
1239 p = OSSL_PARAM_locate_const(options,
1240 OSSL_LIBSSL_RECORD_LAYER_PARAM_READ_AHEAD);
1241 if (p != NULL && !OSSL_PARAM_get_int(p, &rl->read_ahead)) {
1242 ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
1243 return 0;
1244 }
1245 }
1246
1247 return 1;
1248 }
1249
1250 int
tls_int_new_record_layer(OSSL_LIB_CTX * libctx,const char * propq,int vers,int role,int direction,int level,const EVP_CIPHER * ciph,size_t taglen,const EVP_MD * md,COMP_METHOD * comp,BIO * prev,BIO * transport,BIO * next,const OSSL_PARAM * settings,const OSSL_PARAM * options,const OSSL_DISPATCH * fns,void * cbarg,OSSL_RECORD_LAYER ** retrl)1251 tls_int_new_record_layer(OSSL_LIB_CTX *libctx, const char *propq, int vers,
1252 int role, int direction, int level,
1253 const EVP_CIPHER *ciph, size_t taglen,
1254 const EVP_MD *md, COMP_METHOD *comp, BIO *prev,
1255 BIO *transport, BIO *next, const OSSL_PARAM *settings,
1256 const OSSL_PARAM *options,
1257 const OSSL_DISPATCH *fns, void *cbarg,
1258 OSSL_RECORD_LAYER **retrl)
1259 {
1260 OSSL_RECORD_LAYER *rl = OPENSSL_zalloc(sizeof(*rl));
1261 const OSSL_PARAM *p;
1262
1263 *retrl = NULL;
1264
1265 if (rl == NULL)
1266 return OSSL_RECORD_RETURN_FATAL;
1267
1268 /*
1269 * Default the value for max_frag_len. This may be overridden by the
1270 * settings
1271 */
1272 rl->max_frag_len = SSL3_RT_MAX_PLAIN_LENGTH;
1273
1274 /* Loop through all the settings since they must all be understood */
1275 if (settings != NULL) {
1276 for (p = settings; p->key != NULL; p++) {
1277 if (strcmp(p->key, OSSL_LIBSSL_RECORD_LAYER_PARAM_USE_ETM) == 0) {
1278 if (!OSSL_PARAM_get_int(p, &rl->use_etm)) {
1279 ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
1280 goto err;
1281 }
1282 } else if (strcmp(p->key,
1283 OSSL_LIBSSL_RECORD_LAYER_PARAM_MAX_FRAG_LEN) == 0) {
1284 if (!OSSL_PARAM_get_uint(p, &rl->max_frag_len)) {
1285 ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
1286 goto err;
1287 }
1288 } else if (strcmp(p->key,
1289 OSSL_LIBSSL_RECORD_LAYER_PARAM_MAX_EARLY_DATA) == 0) {
1290 if (!OSSL_PARAM_get_uint32(p, &rl->max_early_data)) {
1291 ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
1292 goto err;
1293 }
1294 } else if (strcmp(p->key,
1295 OSSL_LIBSSL_RECORD_LAYER_PARAM_STREAM_MAC) == 0) {
1296 if (!OSSL_PARAM_get_int(p, &rl->stream_mac)) {
1297 ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
1298 goto err;
1299 }
1300 } else if (strcmp(p->key,
1301 OSSL_LIBSSL_RECORD_LAYER_PARAM_TLSTREE) == 0) {
1302 if (!OSSL_PARAM_get_int(p, &rl->tlstree)) {
1303 ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
1304 goto err;
1305 }
1306 } else {
1307 ERR_raise(ERR_LIB_SSL, SSL_R_UNKNOWN_MANDATORY_PARAMETER);
1308 goto err;
1309 }
1310 }
1311 }
1312
1313 rl->libctx = libctx;
1314 rl->propq = propq;
1315
1316 rl->version = vers;
1317 rl->role = role;
1318 rl->direction = direction;
1319 rl->level = level;
1320 rl->taglen = taglen;
1321 rl->md = md;
1322
1323 rl->alert = SSL_AD_NO_ALERT;
1324 rl->rstate = SSL_ST_READ_HEADER;
1325
1326 if (level == OSSL_RECORD_PROTECTION_LEVEL_NONE)
1327 rl->is_first_record = 1;
1328
1329 if (!tls_set1_bio(rl, transport))
1330 goto err;
1331
1332 if (prev != NULL && !BIO_up_ref(prev))
1333 goto err;
1334 rl->prev = prev;
1335
1336 if (next != NULL && !BIO_up_ref(next))
1337 goto err;
1338 rl->next = next;
1339
1340 rl->cbarg = cbarg;
1341 if (fns != NULL) {
1342 for (; fns->function_id != 0; fns++) {
1343 switch (fns->function_id) {
1344 case OSSL_FUNC_RLAYER_SKIP_EARLY_DATA:
1345 rl->skip_early_data = OSSL_FUNC_rlayer_skip_early_data(fns);
1346 break;
1347 case OSSL_FUNC_RLAYER_MSG_CALLBACK:
1348 rl->msg_callback = OSSL_FUNC_rlayer_msg_callback(fns);
1349 break;
1350 case OSSL_FUNC_RLAYER_SECURITY:
1351 rl->security = OSSL_FUNC_rlayer_security(fns);
1352 break;
1353 case OSSL_FUNC_RLAYER_PADDING:
1354 rl->padding = OSSL_FUNC_rlayer_padding(fns);
1355 default:
1356 /* Just ignore anything we don't understand */
1357 break;
1358 }
1359 }
1360 }
1361
1362 if (!tls_set_options(rl, options)) {
1363 ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
1364 goto err;
1365 }
1366
1367 if ((rl->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) == 0
1368 && rl->version <= TLS1_VERSION
1369 && !EVP_CIPHER_is_a(ciph, "NULL")
1370 && !EVP_CIPHER_is_a(ciph, "RC4")) {
1371 /*
1372 * Enable vulnerability countermeasure for CBC ciphers with known-IV
1373 * problem (http://www.openssl.org/~bodo/tls-cbc.txt)
1374 */
1375 rl->need_empty_fragments = 1;
1376 }
1377
1378 *retrl = rl;
1379 return OSSL_RECORD_RETURN_SUCCESS;
1380 err:
1381 tls_int_free(rl);
1382 return OSSL_RECORD_RETURN_FATAL;
1383 }
1384
1385 static int
tls_new_record_layer(OSSL_LIB_CTX * libctx,const char * propq,int vers,int role,int direction,int level,uint16_t epoch,unsigned char * secret,size_t secretlen,unsigned char * key,size_t keylen,unsigned char * iv,size_t ivlen,unsigned char * mackey,size_t mackeylen,const EVP_CIPHER * ciph,size_t taglen,int mactype,const EVP_MD * md,COMP_METHOD * comp,const EVP_MD * kdfdigest,BIO * prev,BIO * transport,BIO * next,BIO_ADDR * local,BIO_ADDR * peer,const OSSL_PARAM * settings,const OSSL_PARAM * options,const OSSL_DISPATCH * fns,void * cbarg,void * rlarg,OSSL_RECORD_LAYER ** retrl)1386 tls_new_record_layer(OSSL_LIB_CTX *libctx, const char *propq, int vers,
1387 int role, int direction, int level, uint16_t epoch,
1388 unsigned char *secret, size_t secretlen,
1389 unsigned char *key, size_t keylen, unsigned char *iv,
1390 size_t ivlen, unsigned char *mackey, size_t mackeylen,
1391 const EVP_CIPHER *ciph, size_t taglen,
1392 int mactype,
1393 const EVP_MD *md, COMP_METHOD *comp,
1394 const EVP_MD *kdfdigest, BIO *prev, BIO *transport,
1395 BIO *next, BIO_ADDR *local, BIO_ADDR *peer,
1396 const OSSL_PARAM *settings, const OSSL_PARAM *options,
1397 const OSSL_DISPATCH *fns, void *cbarg, void *rlarg,
1398 OSSL_RECORD_LAYER **retrl)
1399 {
1400 int ret;
1401
1402 ret = tls_int_new_record_layer(libctx, propq, vers, role, direction, level,
1403 ciph, taglen, md, comp, prev,
1404 transport, next, settings,
1405 options, fns, cbarg, retrl);
1406
1407 if (ret != OSSL_RECORD_RETURN_SUCCESS)
1408 return ret;
1409
1410 switch (vers) {
1411 case TLS_ANY_VERSION:
1412 (*retrl)->funcs = &tls_any_funcs;
1413 break;
1414 case TLS1_3_VERSION:
1415 (*retrl)->funcs = &tls_1_3_funcs;
1416 break;
1417 case TLS1_2_VERSION:
1418 case TLS1_1_VERSION:
1419 case TLS1_VERSION:
1420 (*retrl)->funcs = &tls_1_funcs;
1421 break;
1422 case SSL3_VERSION:
1423 (*retrl)->funcs = &ssl_3_0_funcs;
1424 break;
1425 default:
1426 /* Should not happen */
1427 ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
1428 ret = OSSL_RECORD_RETURN_FATAL;
1429 goto err;
1430 }
1431
1432 ret = (*retrl)->funcs->set_crypto_state(*retrl, level, key, keylen, iv,
1433 ivlen, mackey, mackeylen, ciph,
1434 taglen, mactype, md, comp);
1435
1436 err:
1437 if (ret != OSSL_RECORD_RETURN_SUCCESS) {
1438 tls_int_free(*retrl);
1439 *retrl = NULL;
1440 }
1441 return ret;
1442 }
1443
tls_int_free(OSSL_RECORD_LAYER * rl)1444 static void tls_int_free(OSSL_RECORD_LAYER *rl)
1445 {
1446 BIO_free(rl->prev);
1447 BIO_free(rl->bio);
1448 BIO_free(rl->next);
1449 ossl_tls_buffer_release(&rl->rbuf);
1450
1451 tls_release_write_buffer(rl);
1452
1453 EVP_CIPHER_CTX_free(rl->enc_ctx);
1454 EVP_MAC_CTX_free(rl->mac_ctx);
1455 EVP_MD_CTX_free(rl->md_ctx);
1456 #ifndef OPENSSL_NO_COMP
1457 COMP_CTX_free(rl->compctx);
1458 #endif
1459 OPENSSL_free(rl->iv);
1460 OPENSSL_free(rl->nonce);
1461 if (rl->version == SSL3_VERSION)
1462 OPENSSL_cleanse(rl->mac_secret, sizeof(rl->mac_secret));
1463
1464 TLS_RL_RECORD_release(rl->rrec, SSL_MAX_PIPELINES);
1465
1466 OPENSSL_free(rl);
1467 }
1468
tls_free(OSSL_RECORD_LAYER * rl)1469 int tls_free(OSSL_RECORD_LAYER *rl)
1470 {
1471 TLS_BUFFER *rbuf;
1472 size_t left, written;
1473 int ret = 1;
1474
1475 if (rl == NULL)
1476 return 1;
1477
1478 rbuf = &rl->rbuf;
1479
1480 left = TLS_BUFFER_get_left(rbuf);
1481 if (left > 0) {
1482 /*
1483 * This record layer is closing but we still have data left in our
1484 * buffer. It must be destined for the next epoch - so push it there.
1485 */
1486 ret = BIO_write_ex(rl->next, rbuf->buf + rbuf->offset, left, &written);
1487 }
1488 tls_int_free(rl);
1489
1490 return ret;
1491 }
1492
tls_unprocessed_read_pending(OSSL_RECORD_LAYER * rl)1493 int tls_unprocessed_read_pending(OSSL_RECORD_LAYER *rl)
1494 {
1495 return TLS_BUFFER_get_left(&rl->rbuf) != 0;
1496 }
1497
tls_processed_read_pending(OSSL_RECORD_LAYER * rl)1498 int tls_processed_read_pending(OSSL_RECORD_LAYER *rl)
1499 {
1500 return rl->curr_rec < rl->num_recs;
1501 }
1502
tls_app_data_pending(OSSL_RECORD_LAYER * rl)1503 size_t tls_app_data_pending(OSSL_RECORD_LAYER *rl)
1504 {
1505 size_t i;
1506 size_t num = 0;
1507
1508 for (i = rl->curr_rec; i < rl->num_recs; i++) {
1509 if (rl->rrec[i].type != SSL3_RT_APPLICATION_DATA)
1510 return num;
1511 num += rl->rrec[i].length;
1512 }
1513 return num;
1514 }
1515
tls_get_max_records_default(OSSL_RECORD_LAYER * rl,uint8_t type,size_t len,size_t maxfrag,size_t * preffrag)1516 size_t tls_get_max_records_default(OSSL_RECORD_LAYER *rl, uint8_t type,
1517 size_t len,
1518 size_t maxfrag, size_t *preffrag)
1519 {
1520 /*
1521 * If we have a pipeline capable cipher, and we have been configured to use
1522 * it, then return the preferred number of pipelines.
1523 */
1524 if (rl->max_pipelines > 0
1525 && rl->enc_ctx != NULL
1526 && (EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(rl->enc_ctx))
1527 & EVP_CIPH_FLAG_PIPELINE) != 0
1528 && RLAYER_USE_EXPLICIT_IV(rl)) {
1529 size_t pipes;
1530
1531 if (len == 0)
1532 return 1;
1533 pipes = ((len - 1) / *preffrag) + 1;
1534
1535 return (pipes < rl->max_pipelines) ? pipes : rl->max_pipelines;
1536 }
1537
1538 return 1;
1539 }
1540
tls_get_max_records(OSSL_RECORD_LAYER * rl,uint8_t type,size_t len,size_t maxfrag,size_t * preffrag)1541 size_t tls_get_max_records(OSSL_RECORD_LAYER *rl, uint8_t type, size_t len,
1542 size_t maxfrag, size_t *preffrag)
1543 {
1544 return rl->funcs->get_max_records(rl, type, len, maxfrag, preffrag);
1545 }
1546
tls_allocate_write_buffers_default(OSSL_RECORD_LAYER * rl,OSSL_RECORD_TEMPLATE * templates,size_t numtempl,size_t * prefix)1547 int tls_allocate_write_buffers_default(OSSL_RECORD_LAYER *rl,
1548 OSSL_RECORD_TEMPLATE *templates,
1549 size_t numtempl,
1550 size_t *prefix)
1551 {
1552 if (!tls_setup_write_buffer(rl, numtempl, 0, 0)) {
1553 /* RLAYERfatal() already called */
1554 return 0;
1555 }
1556
1557 return 1;
1558 }
1559
tls_initialise_write_packets_default(OSSL_RECORD_LAYER * rl,OSSL_RECORD_TEMPLATE * templates,size_t numtempl,OSSL_RECORD_TEMPLATE * prefixtempl,WPACKET * pkt,TLS_BUFFER * bufs,size_t * wpinited)1560 int tls_initialise_write_packets_default(OSSL_RECORD_LAYER *rl,
1561 OSSL_RECORD_TEMPLATE *templates,
1562 size_t numtempl,
1563 OSSL_RECORD_TEMPLATE *prefixtempl,
1564 WPACKET *pkt,
1565 TLS_BUFFER *bufs,
1566 size_t *wpinited)
1567 {
1568 WPACKET *thispkt;
1569 size_t j, align;
1570 TLS_BUFFER *wb;
1571
1572 for (j = 0; j < numtempl; j++) {
1573 thispkt = &pkt[j];
1574 wb = &bufs[j];
1575
1576 wb->type = templates[j].type;
1577
1578 #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD != 0
1579 align = (size_t)TLS_BUFFER_get_buf(wb);
1580 align += rl->isdtls ? DTLS1_RT_HEADER_LENGTH : SSL3_RT_HEADER_LENGTH;
1581 align = SSL3_ALIGN_PAYLOAD - 1
1582 - ((align - 1) % SSL3_ALIGN_PAYLOAD);
1583 #endif
1584 TLS_BUFFER_set_offset(wb, align);
1585
1586 if (!WPACKET_init_static_len(thispkt, TLS_BUFFER_get_buf(wb),
1587 TLS_BUFFER_get_len(wb), 0)) {
1588 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1589 return 0;
1590 }
1591 (*wpinited)++;
1592 if (!WPACKET_allocate_bytes(thispkt, align, NULL)) {
1593 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1594 return 0;
1595 }
1596 }
1597
1598 return 1;
1599 }
1600
tls_prepare_record_header_default(OSSL_RECORD_LAYER * rl,WPACKET * thispkt,OSSL_RECORD_TEMPLATE * templ,uint8_t rectype,unsigned char ** recdata)1601 int tls_prepare_record_header_default(OSSL_RECORD_LAYER *rl,
1602 WPACKET *thispkt,
1603 OSSL_RECORD_TEMPLATE *templ,
1604 uint8_t rectype,
1605 unsigned char **recdata)
1606 {
1607 size_t maxcomplen;
1608
1609 *recdata = NULL;
1610
1611 maxcomplen = templ->buflen;
1612 if (rl->compctx != NULL)
1613 maxcomplen += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
1614
1615 if (!WPACKET_put_bytes_u8(thispkt, rectype)
1616 || !WPACKET_put_bytes_u16(thispkt, templ->version)
1617 || !WPACKET_start_sub_packet_u16(thispkt)
1618 || (rl->eivlen > 0
1619 && !WPACKET_allocate_bytes(thispkt, rl->eivlen, NULL))
1620 || (maxcomplen > 0
1621 && !WPACKET_reserve_bytes(thispkt, maxcomplen,
1622 recdata))) {
1623 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1624 return 0;
1625 }
1626
1627 return 1;
1628 }
1629
tls_prepare_for_encryption_default(OSSL_RECORD_LAYER * rl,size_t mac_size,WPACKET * thispkt,TLS_RL_RECORD * thiswr)1630 int tls_prepare_for_encryption_default(OSSL_RECORD_LAYER *rl,
1631 size_t mac_size,
1632 WPACKET *thispkt,
1633 TLS_RL_RECORD *thiswr)
1634 {
1635 size_t len;
1636 unsigned char *recordstart;
1637
1638 /*
1639 * we should still have the output to thiswr->data and the input from
1640 * wr->input. Length should be thiswr->length. thiswr->data still points
1641 * in the wb->buf
1642 */
1643
1644 if (!rl->use_etm && mac_size != 0) {
1645 unsigned char *mac;
1646
1647 if (!WPACKET_allocate_bytes(thispkt, mac_size, &mac)
1648 || !rl->funcs->mac(rl, thiswr, mac, 1)) {
1649 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1650 return 0;
1651 }
1652 }
1653
1654 /*
1655 * Reserve some bytes for any growth that may occur during encryption. If
1656 * we are adding the MAC independently of the cipher algorithm, then the
1657 * max encrypted overhead does not need to include an allocation for that
1658 * MAC
1659 */
1660 if (!WPACKET_reserve_bytes(thispkt, SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD
1661 - mac_size, NULL)
1662 /*
1663 * We also need next the amount of bytes written to this
1664 * sub-packet
1665 */
1666 || !WPACKET_get_length(thispkt, &len)) {
1667 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1668 return 0;
1669 }
1670
1671 /* Get a pointer to the start of this record excluding header */
1672 recordstart = WPACKET_get_curr(thispkt) - len;
1673 TLS_RL_RECORD_set_data(thiswr, recordstart);
1674 TLS_RL_RECORD_reset_input(thiswr);
1675 TLS_RL_RECORD_set_length(thiswr, len);
1676
1677 return 1;
1678 }
1679
tls_post_encryption_processing_default(OSSL_RECORD_LAYER * rl,size_t mac_size,OSSL_RECORD_TEMPLATE * thistempl,WPACKET * thispkt,TLS_RL_RECORD * thiswr)1680 int tls_post_encryption_processing_default(OSSL_RECORD_LAYER *rl,
1681 size_t mac_size,
1682 OSSL_RECORD_TEMPLATE *thistempl,
1683 WPACKET *thispkt,
1684 TLS_RL_RECORD *thiswr)
1685 {
1686 size_t origlen, len;
1687 size_t headerlen = rl->isdtls ? DTLS1_RT_HEADER_LENGTH
1688 : SSL3_RT_HEADER_LENGTH;
1689
1690 /* Allocate bytes for the encryption overhead */
1691 if (!WPACKET_get_length(thispkt, &origlen)
1692 /* Check we allowed enough room for the encryption growth */
1693 || !ossl_assert(origlen + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD
1694 - mac_size >= thiswr->length)
1695 /* Encryption should never shrink the data! */
1696 || origlen > thiswr->length
1697 || (thiswr->length > origlen
1698 && !WPACKET_allocate_bytes(thispkt,
1699 thiswr->length - origlen,
1700 NULL))) {
1701 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1702 return 0;
1703 }
1704 if (rl->use_etm && mac_size != 0) {
1705 unsigned char *mac;
1706
1707 if (!WPACKET_allocate_bytes(thispkt, mac_size, &mac)
1708 || !rl->funcs->mac(rl, thiswr, mac, 1)) {
1709 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1710 return 0;
1711 }
1712
1713 TLS_RL_RECORD_add_length(thiswr, mac_size);
1714 }
1715
1716 if (!WPACKET_get_length(thispkt, &len)
1717 || !WPACKET_close(thispkt)) {
1718 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1719 return 0;
1720 }
1721
1722 if (rl->msg_callback != NULL) {
1723 unsigned char *recordstart;
1724
1725 recordstart = WPACKET_get_curr(thispkt) - len - headerlen;
1726 rl->msg_callback(1, thiswr->rec_version, SSL3_RT_HEADER, recordstart,
1727 headerlen, rl->cbarg);
1728
1729 if (rl->version == TLS1_3_VERSION && rl->enc_ctx != NULL) {
1730 unsigned char ctype = thistempl->type;
1731
1732 rl->msg_callback(1, thiswr->rec_version, SSL3_RT_INNER_CONTENT_TYPE,
1733 &ctype, 1, rl->cbarg);
1734 }
1735 }
1736
1737 if (!WPACKET_finish(thispkt)) {
1738 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1739 return 0;
1740 }
1741
1742 TLS_RL_RECORD_add_length(thiswr, headerlen);
1743
1744 return 1;
1745 }
1746
tls_write_records_default(OSSL_RECORD_LAYER * rl,OSSL_RECORD_TEMPLATE * templates,size_t numtempl)1747 int tls_write_records_default(OSSL_RECORD_LAYER *rl,
1748 OSSL_RECORD_TEMPLATE *templates,
1749 size_t numtempl)
1750 {
1751 WPACKET pkt[SSL_MAX_PIPELINES + 1];
1752 TLS_RL_RECORD wr[SSL_MAX_PIPELINES + 1];
1753 WPACKET *thispkt;
1754 TLS_RL_RECORD *thiswr;
1755 int mac_size = 0, ret = 0;
1756 size_t wpinited = 0;
1757 size_t j, prefix = 0;
1758 OSSL_RECORD_TEMPLATE prefixtempl;
1759 OSSL_RECORD_TEMPLATE *thistempl;
1760
1761 if (rl->md_ctx != NULL && EVP_MD_CTX_get0_md(rl->md_ctx) != NULL) {
1762 mac_size = EVP_MD_CTX_get_size(rl->md_ctx);
1763 if (mac_size < 0) {
1764 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1765 goto err;
1766 }
1767 }
1768
1769 if (!rl->funcs->allocate_write_buffers(rl, templates, numtempl, &prefix)) {
1770 /* RLAYERfatal() already called */
1771 goto err;
1772 }
1773
1774 if (!rl->funcs->initialise_write_packets(rl, templates, numtempl,
1775 &prefixtempl, pkt, rl->wbuf,
1776 &wpinited)) {
1777 /* RLAYERfatal() already called */
1778 goto err;
1779 }
1780
1781 /* Clear our TLS_RL_RECORD structures */
1782 memset(wr, 0, sizeof(wr));
1783 for (j = 0; j < numtempl + prefix; j++) {
1784 unsigned char *compressdata = NULL;
1785 uint8_t rectype;
1786
1787 thispkt = &pkt[j];
1788 thiswr = &wr[j];
1789 thistempl = (j < prefix) ? &prefixtempl : &templates[j - prefix];
1790
1791 /*
1792 * Default to the record type as specified in the template unless the
1793 * protocol implementation says differently.
1794 */
1795 if (rl->funcs->get_record_type != NULL)
1796 rectype = rl->funcs->get_record_type(rl, thistempl);
1797 else
1798 rectype = thistempl->type;
1799
1800 TLS_RL_RECORD_set_type(thiswr, rectype);
1801 TLS_RL_RECORD_set_rec_version(thiswr, thistempl->version);
1802
1803 if (!rl->funcs->prepare_record_header(rl, thispkt, thistempl, rectype,
1804 &compressdata)) {
1805 /* RLAYERfatal() already called */
1806 goto err;
1807 }
1808
1809 /* lets setup the record stuff. */
1810 TLS_RL_RECORD_set_data(thiswr, compressdata);
1811 TLS_RL_RECORD_set_length(thiswr, thistempl->buflen);
1812
1813 TLS_RL_RECORD_set_input(thiswr, (unsigned char *)thistempl->buf);
1814
1815 /*
1816 * we now 'read' from thiswr->input, thiswr->length bytes into
1817 * thiswr->data
1818 */
1819
1820 /* first we compress */
1821 if (rl->compctx != NULL) {
1822 if (!tls_do_compress(rl, thiswr)
1823 || !WPACKET_allocate_bytes(thispkt, thiswr->length, NULL)) {
1824 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, SSL_R_COMPRESSION_FAILURE);
1825 goto err;
1826 }
1827 } else if (compressdata != NULL) {
1828 if (!WPACKET_memcpy(thispkt, thiswr->input, thiswr->length)) {
1829 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1830 goto err;
1831 }
1832 TLS_RL_RECORD_reset_input(&wr[j]);
1833 }
1834
1835 if (rl->funcs->add_record_padding != NULL
1836 && !rl->funcs->add_record_padding(rl, thistempl, thispkt,
1837 thiswr)) {
1838 /* RLAYERfatal() already called */
1839 goto err;
1840 }
1841
1842 if (!rl->funcs->prepare_for_encryption(rl, mac_size, thispkt, thiswr)) {
1843 /* RLAYERfatal() already called */
1844 goto err;
1845 }
1846 }
1847
1848 if (prefix) {
1849 if (rl->funcs->cipher(rl, wr, 1, 1, NULL, mac_size) < 1) {
1850 if (rl->alert == SSL_AD_NO_ALERT) {
1851 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1852 }
1853 goto err;
1854 }
1855 }
1856
1857 if (rl->funcs->cipher(rl, wr + prefix, numtempl, 1, NULL, mac_size) < 1) {
1858 if (rl->alert == SSL_AD_NO_ALERT) {
1859 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
1860 }
1861 goto err;
1862 }
1863
1864 for (j = 0; j < numtempl + prefix; j++) {
1865 thispkt = &pkt[j];
1866 thiswr = &wr[j];
1867 thistempl = (j < prefix) ? &prefixtempl : &templates[j - prefix];
1868
1869 if (!rl->funcs->post_encryption_processing(rl, mac_size, thistempl,
1870 thispkt, thiswr)) {
1871 /* RLAYERfatal() already called */
1872 goto err;
1873 }
1874
1875 /* now let's set up wb */
1876 TLS_BUFFER_set_left(&rl->wbuf[j], TLS_RL_RECORD_get_length(thiswr));
1877 }
1878
1879 ret = 1;
1880 err:
1881 for (j = 0; j < wpinited; j++)
1882 WPACKET_cleanup(&pkt[j]);
1883 return ret;
1884 }
1885
tls_write_records(OSSL_RECORD_LAYER * rl,OSSL_RECORD_TEMPLATE * templates,size_t numtempl)1886 int tls_write_records(OSSL_RECORD_LAYER *rl, OSSL_RECORD_TEMPLATE *templates,
1887 size_t numtempl)
1888 {
1889 /* Check we don't have pending data waiting to write */
1890 if (!ossl_assert(rl->nextwbuf >= rl->numwpipes
1891 || TLS_BUFFER_get_left(&rl->wbuf[rl->nextwbuf]) == 0)) {
1892 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1893 return OSSL_RECORD_RETURN_FATAL;
1894 }
1895
1896 if (!rl->funcs->write_records(rl, templates, numtempl)) {
1897 /* RLAYERfatal already called */
1898 return OSSL_RECORD_RETURN_FATAL;
1899 }
1900
1901 rl->nextwbuf = 0;
1902 /* we now just need to write the buffers */
1903 return tls_retry_write_records(rl);
1904 }
1905
tls_retry_write_records(OSSL_RECORD_LAYER * rl)1906 int tls_retry_write_records(OSSL_RECORD_LAYER *rl)
1907 {
1908 int i, ret;
1909 TLS_BUFFER *thiswb;
1910 size_t tmpwrit = 0;
1911
1912 if (rl->nextwbuf >= rl->numwpipes)
1913 return OSSL_RECORD_RETURN_SUCCESS;
1914
1915 for (;;) {
1916 thiswb = &rl->wbuf[rl->nextwbuf];
1917
1918 clear_sys_error();
1919 if (rl->bio != NULL) {
1920 if (rl->funcs->prepare_write_bio != NULL) {
1921 ret = rl->funcs->prepare_write_bio(rl, thiswb->type);
1922 if (ret != OSSL_RECORD_RETURN_SUCCESS)
1923 return ret;
1924 }
1925 i = BIO_write(rl->bio, (char *)
1926 &(TLS_BUFFER_get_buf(thiswb)
1927 [TLS_BUFFER_get_offset(thiswb)]),
1928 (unsigned int)TLS_BUFFER_get_left(thiswb));
1929 if (i >= 0) {
1930 tmpwrit = i;
1931 if (i == 0 && BIO_should_retry(rl->bio))
1932 ret = OSSL_RECORD_RETURN_RETRY;
1933 else
1934 ret = OSSL_RECORD_RETURN_SUCCESS;
1935 } else {
1936 if (BIO_should_retry(rl->bio)) {
1937 ret = OSSL_RECORD_RETURN_RETRY;
1938 } else {
1939 ERR_raise_data(ERR_LIB_SYS, get_last_sys_error(),
1940 "tls_retry_write_records failure");
1941 ret = OSSL_RECORD_RETURN_FATAL;
1942 }
1943 }
1944 } else {
1945 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, SSL_R_BIO_NOT_SET);
1946 ret = OSSL_RECORD_RETURN_FATAL;
1947 i = -1;
1948 }
1949
1950 /*
1951 * When an empty fragment is sent on a connection using KTLS,
1952 * it is sent as a write of zero bytes. If this zero byte
1953 * write succeeds, i will be 0 rather than a non-zero value.
1954 * Treat i == 0 as success rather than an error for zero byte
1955 * writes to permit this case.
1956 */
1957 if (i >= 0 && tmpwrit == TLS_BUFFER_get_left(thiswb)) {
1958 TLS_BUFFER_set_left(thiswb, 0);
1959 TLS_BUFFER_add_offset(thiswb, tmpwrit);
1960 if (++(rl->nextwbuf) < rl->numwpipes)
1961 continue;
1962
1963 if (rl->nextwbuf == rl->numwpipes
1964 && (rl->mode & SSL_MODE_RELEASE_BUFFERS) != 0)
1965 tls_release_write_buffer(rl);
1966 return OSSL_RECORD_RETURN_SUCCESS;
1967 } else if (i <= 0) {
1968 if (rl->isdtls) {
1969 /*
1970 * For DTLS, just drop it. That's kind of the whole point in
1971 * using a datagram service
1972 */
1973 TLS_BUFFER_set_left(thiswb, 0);
1974 if (++(rl->nextwbuf) == rl->numwpipes
1975 && (rl->mode & SSL_MODE_RELEASE_BUFFERS) != 0)
1976 tls_release_write_buffer(rl);
1977
1978 }
1979 return ret;
1980 }
1981 TLS_BUFFER_add_offset(thiswb, tmpwrit);
1982 TLS_BUFFER_sub_left(thiswb, tmpwrit);
1983 }
1984 }
1985
tls_get_alert_code(OSSL_RECORD_LAYER * rl)1986 int tls_get_alert_code(OSSL_RECORD_LAYER *rl)
1987 {
1988 return rl->alert;
1989 }
1990
tls_set1_bio(OSSL_RECORD_LAYER * rl,BIO * bio)1991 int tls_set1_bio(OSSL_RECORD_LAYER *rl, BIO *bio)
1992 {
1993 if (bio != NULL && !BIO_up_ref(bio))
1994 return 0;
1995 BIO_free(rl->bio);
1996 rl->bio = bio;
1997
1998 return 1;
1999 }
2000
2001 /* Shared by most methods except tlsany_meth */
tls_default_set_protocol_version(OSSL_RECORD_LAYER * rl,int version)2002 int tls_default_set_protocol_version(OSSL_RECORD_LAYER *rl, int version)
2003 {
2004 if (rl->version != version)
2005 return 0;
2006
2007 return 1;
2008 }
2009
tls_set_protocol_version(OSSL_RECORD_LAYER * rl,int version)2010 int tls_set_protocol_version(OSSL_RECORD_LAYER *rl, int version)
2011 {
2012 return rl->funcs->set_protocol_version(rl, version);
2013 }
2014
tls_set_plain_alerts(OSSL_RECORD_LAYER * rl,int allow)2015 void tls_set_plain_alerts(OSSL_RECORD_LAYER *rl, int allow)
2016 {
2017 rl->allow_plain_alerts = allow;
2018 }
2019
tls_set_first_handshake(OSSL_RECORD_LAYER * rl,int first)2020 void tls_set_first_handshake(OSSL_RECORD_LAYER *rl, int first)
2021 {
2022 rl->is_first_handshake = first;
2023 }
2024
tls_set_max_pipelines(OSSL_RECORD_LAYER * rl,size_t max_pipelines)2025 void tls_set_max_pipelines(OSSL_RECORD_LAYER *rl, size_t max_pipelines)
2026 {
2027 rl->max_pipelines = max_pipelines;
2028 if (max_pipelines > 1)
2029 rl->read_ahead = 1;
2030 }
2031
tls_get_state(OSSL_RECORD_LAYER * rl,const char ** shortstr,const char ** longstr)2032 void tls_get_state(OSSL_RECORD_LAYER *rl, const char **shortstr,
2033 const char **longstr)
2034 {
2035 const char *shrt, *lng;
2036
2037 switch (rl->rstate) {
2038 case SSL_ST_READ_HEADER:
2039 shrt = "RH";
2040 lng = "read header";
2041 break;
2042 case SSL_ST_READ_BODY:
2043 shrt = "RB";
2044 lng = "read body";
2045 break;
2046 default:
2047 shrt = lng = "unknown";
2048 break;
2049 }
2050 if (shortstr != NULL)
2051 *shortstr = shrt;
2052 if (longstr != NULL)
2053 *longstr = lng;
2054 }
2055
tls_get_compression(OSSL_RECORD_LAYER * rl)2056 const COMP_METHOD *tls_get_compression(OSSL_RECORD_LAYER *rl)
2057 {
2058 #ifndef OPENSSL_NO_COMP
2059 return (rl->compctx == NULL) ? NULL : COMP_CTX_get_method(rl->compctx);
2060 #else
2061 return NULL;
2062 #endif
2063 }
2064
tls_set_max_frag_len(OSSL_RECORD_LAYER * rl,size_t max_frag_len)2065 void tls_set_max_frag_len(OSSL_RECORD_LAYER *rl, size_t max_frag_len)
2066 {
2067 rl->max_frag_len = max_frag_len;
2068 /*
2069 * We don't need to adjust buffer sizes. Write buffer sizes are
2070 * automatically checked anyway. We should only be changing the read buffer
2071 * size during the handshake, so we will create a new buffer when we create
2072 * the new record layer. We can't change the existing buffer because it may
2073 * already have data in it.
2074 */
2075 }
2076
tls_increment_sequence_ctr(OSSL_RECORD_LAYER * rl)2077 int tls_increment_sequence_ctr(OSSL_RECORD_LAYER *rl)
2078 {
2079 int i;
2080
2081 /* Increment the sequence counter */
2082 for (i = SEQ_NUM_SIZE; i > 0; i--) {
2083 ++(rl->sequence[i - 1]);
2084 if (rl->sequence[i - 1] != 0)
2085 break;
2086 }
2087 if (i == 0) {
2088 /* Sequence has wrapped */
2089 RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, SSL_R_SEQUENCE_CTR_WRAPPED);
2090 return 0;
2091 }
2092 return 1;
2093 }
2094
tls_alloc_buffers(OSSL_RECORD_LAYER * rl)2095 int tls_alloc_buffers(OSSL_RECORD_LAYER *rl)
2096 {
2097 if (rl->direction == OSSL_RECORD_DIRECTION_WRITE) {
2098 /* If we have a pending write then buffers are already allocated */
2099 if (rl->nextwbuf < rl->numwpipes)
2100 return 1;
2101 /*
2102 * We assume 1 pipe with default sized buffer. If what we need ends up
2103 * being a different size to that then it will be reallocated on demand.
2104 * If we need more than 1 pipe then that will also be allocated on
2105 * demand
2106 */
2107 if (!tls_setup_write_buffer(rl, 1, 0, 0))
2108 return 0;
2109
2110 /*
2111 * Normally when we allocate write buffers we immediately write
2112 * something into it. In this case we're not doing that so mark the
2113 * buffer as empty.
2114 */
2115 TLS_BUFFER_set_left(&rl->wbuf[0], 0);
2116 return 1;
2117 }
2118
2119 /* Read direction */
2120
2121 /* If we have pending data to be read then buffers are already allocated */
2122 if (rl->curr_rec < rl->num_recs || TLS_BUFFER_get_left(&rl->rbuf) != 0)
2123 return 1;
2124 return tls_setup_read_buffer(rl);
2125 }
2126
tls_free_buffers(OSSL_RECORD_LAYER * rl)2127 int tls_free_buffers(OSSL_RECORD_LAYER *rl)
2128 {
2129 if (rl->direction == OSSL_RECORD_DIRECTION_WRITE) {
2130 if (rl->nextwbuf < rl->numwpipes) {
2131 /*
2132 * We may have pending data. If we've just got one empty buffer
2133 * allocated then it has probably just been alloc'd via
2134 * tls_alloc_buffers, and it is fine to free it. Otherwise this
2135 * looks like real pending data and it is an error.
2136 */
2137 if (rl->nextwbuf != 0
2138 || rl->numwpipes != 1
2139 || TLS_BUFFER_get_left(&rl->wbuf[0]) != 0)
2140 return 0;
2141 }
2142 tls_release_write_buffer(rl);
2143 return 1;
2144 }
2145
2146 /* Read direction */
2147
2148 /* If we have pending data to be read then fail */
2149 if (rl->curr_rec < rl->num_recs
2150 || rl->curr_rec != rl->num_released
2151 || TLS_BUFFER_get_left(&rl->rbuf) != 0
2152 || rl->rstate == SSL_ST_READ_BODY)
2153 return 0;
2154
2155 return tls_release_read_buffer(rl);
2156 }
2157
2158 const OSSL_RECORD_METHOD ossl_tls_record_method = {
2159 tls_new_record_layer,
2160 tls_free,
2161 tls_unprocessed_read_pending,
2162 tls_processed_read_pending,
2163 tls_app_data_pending,
2164 tls_get_max_records,
2165 tls_write_records,
2166 tls_retry_write_records,
2167 tls_read_record,
2168 tls_release_record,
2169 tls_get_alert_code,
2170 tls_set1_bio,
2171 tls_set_protocol_version,
2172 tls_set_plain_alerts,
2173 tls_set_first_handshake,
2174 tls_set_max_pipelines,
2175 NULL,
2176 tls_get_state,
2177 tls_set_options,
2178 tls_get_compression,
2179 tls_set_max_frag_len,
2180 NULL,
2181 tls_increment_sequence_ctr,
2182 tls_alloc_buffers,
2183 tls_free_buffers
2184 };
2185
