1 /*
2 * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <assert.h>
11 #include "../ssl_local.h"
12 #include <openssl/trace.h>
13 #include <openssl/rand.h>
14 #include <openssl/core_names.h>
15 #include "record_local.h"
16 #include "internal/cryptlib.h"
17
18 static const unsigned char ssl3_pad_1[48] = {
19 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
20 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
21 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
22 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
23 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
24 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36
25 };
26
27 static const unsigned char ssl3_pad_2[48] = {
28 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
29 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
30 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
31 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
32 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
33 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c
34 };
35
36 /*
37 * Clear the contents of an SSL3_RECORD but retain any memory allocated
38 */
SSL3_RECORD_clear(SSL3_RECORD * r,size_t num_recs)39 void SSL3_RECORD_clear(SSL3_RECORD *r, size_t num_recs)
40 {
41 unsigned char *comp;
42 size_t i;
43
44 for (i = 0; i < num_recs; i++) {
45 comp = r[i].comp;
46
47 memset(&r[i], 0, sizeof(*r));
48 r[i].comp = comp;
49 }
50 }
51
SSL3_RECORD_release(SSL3_RECORD * r,size_t num_recs)52 void SSL3_RECORD_release(SSL3_RECORD *r, size_t num_recs)
53 {
54 size_t i;
55
56 for (i = 0; i < num_recs; i++) {
57 OPENSSL_free(r[i].comp);
58 r[i].comp = NULL;
59 }
60 }
61
SSL3_RECORD_set_seq_num(SSL3_RECORD * r,const unsigned char * seq_num)62 void SSL3_RECORD_set_seq_num(SSL3_RECORD *r, const unsigned char *seq_num)
63 {
64 memcpy(r->seq_num, seq_num, SEQ_NUM_SIZE);
65 }
66
ossl_get_max_early_data(SSL_CONNECTION * s)67 uint32_t ossl_get_max_early_data(SSL_CONNECTION *s)
68 {
69 uint32_t max_early_data;
70 SSL_SESSION *sess = s->session;
71
72 /*
73 * If we are a client then we always use the max_early_data from the
74 * session/psksession. Otherwise we go with the lowest out of the max early
75 * data set in the session and the configured max_early_data.
76 */
77 if (!s->server && sess->ext.max_early_data == 0) {
78 if (!ossl_assert(s->psksession != NULL
79 && s->psksession->ext.max_early_data > 0)) {
80 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
81 return 0;
82 }
83 sess = s->psksession;
84 }
85
86 if (!s->server)
87 max_early_data = sess->ext.max_early_data;
88 else if (s->ext.early_data != SSL_EARLY_DATA_ACCEPTED)
89 max_early_data = s->recv_max_early_data;
90 else
91 max_early_data = s->recv_max_early_data < sess->ext.max_early_data
92 ? s->recv_max_early_data : sess->ext.max_early_data;
93
94 return max_early_data;
95 }
96
ossl_early_data_count_ok(SSL_CONNECTION * s,size_t length,size_t overhead,int send)97 int ossl_early_data_count_ok(SSL_CONNECTION *s, size_t length, size_t overhead,
98 int send)
99 {
100 uint32_t max_early_data;
101
102 max_early_data = ossl_get_max_early_data(s);
103
104 if (max_early_data == 0) {
105 SSLfatal(s, send ? SSL_AD_INTERNAL_ERROR : SSL_AD_UNEXPECTED_MESSAGE,
106 SSL_R_TOO_MUCH_EARLY_DATA);
107 return 0;
108 }
109
110 /* If we are dealing with ciphertext we need to allow for the overhead */
111 max_early_data += overhead;
112
113 if (s->early_data_count + length > max_early_data) {
114 SSLfatal(s, send ? SSL_AD_INTERNAL_ERROR : SSL_AD_UNEXPECTED_MESSAGE,
115 SSL_R_TOO_MUCH_EARLY_DATA);
116 return 0;
117 }
118 s->early_data_count += length;
119
120 return 1;
121 }
122
ssl3_do_uncompress(SSL_CONNECTION * ssl,SSL3_RECORD * rr)123 int ssl3_do_uncompress(SSL_CONNECTION *ssl, SSL3_RECORD *rr)
124 {
125 #ifndef OPENSSL_NO_COMP
126 int i;
127
128 if (rr->comp == NULL) {
129 rr->comp = (unsigned char *)
130 OPENSSL_malloc(SSL3_RT_MAX_ENCRYPTED_LENGTH);
131 }
132 if (rr->comp == NULL)
133 return 0;
134
135 i = COMP_expand_block(ssl->expand, rr->comp,
136 SSL3_RT_MAX_PLAIN_LENGTH, rr->data, (int)rr->length);
137 if (i < 0)
138 return 0;
139 else
140 rr->length = i;
141 rr->data = rr->comp;
142 #endif
143 return 1;
144 }
145
ssl3_do_compress(SSL_CONNECTION * sc,SSL3_RECORD * wr)146 int ssl3_do_compress(SSL_CONNECTION *sc, SSL3_RECORD *wr)
147 {
148 #ifndef OPENSSL_NO_COMP
149 int i;
150
151 i = COMP_compress_block(sc->compress, wr->data,
152 (int)(wr->length + SSL3_RT_MAX_COMPRESSED_OVERHEAD),
153 wr->input, (int)wr->length);
154 if (i < 0)
155 return 0;
156 else
157 wr->length = i;
158
159 wr->input = wr->data;
160 #endif
161 return 1;
162 }
163
164 /*-
165 * ssl3_enc encrypts/decrypts |n_recs| records in |inrecs|. Calls SSLfatal on
166 * internal error, but not otherwise. It is the responsibility of the caller to
167 * report a bad_record_mac
168 *
169 * Returns:
170 * 0: if the record is publicly invalid, or an internal error
171 * 1: Success or Mac-then-encrypt decryption failed (MAC will be randomised)
172 */
ssl3_enc(SSL_CONNECTION * s,SSL3_RECORD * inrecs,size_t n_recs,int sending,SSL_MAC_BUF * mac,size_t macsize)173 int ssl3_enc(SSL_CONNECTION *s, SSL3_RECORD *inrecs, size_t n_recs, int sending,
174 SSL_MAC_BUF *mac, size_t macsize)
175 {
176 SSL3_RECORD *rec;
177 EVP_CIPHER_CTX *ds;
178 size_t l, i;
179 size_t bs;
180 const EVP_CIPHER *enc;
181
182 assert(sending);
183 rec = inrecs;
184 /*
185 * We shouldn't ever be called with more than one record in the SSLv3 case
186 */
187 if (n_recs != 1)
188 return 0;
189
190 ds = s->enc_write_ctx;
191 if (s->enc_write_ctx == NULL)
192 enc = NULL;
193 else
194 enc = EVP_CIPHER_CTX_get0_cipher(s->enc_write_ctx);
195
196 if ((s->session == NULL) || (ds == NULL) || (enc == NULL)) {
197 memmove(rec->data, rec->input, rec->length);
198 rec->input = rec->data;
199 } else {
200 int provided = (EVP_CIPHER_get0_provider(enc) != NULL);
201
202 l = rec->length;
203 bs = EVP_CIPHER_CTX_get_block_size(ds);
204
205 /* COMPRESS */
206
207 if ((bs != 1) && !provided) {
208 /*
209 * We only do this for legacy ciphers. Provided ciphers add the
210 * padding on the provider side.
211 */
212 i = bs - (l % bs);
213
214 /* we need to add 'i-1' padding bytes */
215 l += i;
216 /*
217 * the last of these zero bytes will be overwritten with the
218 * padding length.
219 */
220 memset(&rec->input[rec->length], 0, i);
221 rec->length += i;
222 rec->input[l - 1] = (unsigned char)(i - 1);
223 }
224
225 if (EVP_CIPHER_get0_provider(enc) != NULL) {
226 int outlen;
227
228 if (!EVP_CipherUpdate(ds, rec->data, &outlen, rec->input,
229 (unsigned int)l))
230 return 0;
231 rec->length = outlen;
232 } else {
233 if (EVP_Cipher(ds, rec->data, rec->input, (unsigned int)l) < 1) {
234 /* Shouldn't happen */
235 SSLfatal(s, SSL_AD_BAD_RECORD_MAC, ERR_R_INTERNAL_ERROR);
236 return 0;
237 }
238 }
239 }
240 return 1;
241 }
242
243 #define MAX_PADDING 256
244 /*-
245 * tls1_enc encrypts/decrypts |n_recs| in |recs|. Calls SSLfatal on internal
246 * error, but not otherwise. It is the responsibility of the caller to report
247 * a bad_record_mac - if appropriate (DTLS just drops the record).
248 *
249 * Returns:
250 * 0: if the record is publicly invalid, or an internal error, or AEAD
251 * decryption failed, or Encrypt-then-mac decryption failed.
252 * 1: Success or Mac-then-encrypt decryption failed (MAC will be randomised)
253 */
tls1_enc(SSL_CONNECTION * s,SSL3_RECORD * recs,size_t n_recs,int sending,SSL_MAC_BUF * macs,size_t macsize)254 int tls1_enc(SSL_CONNECTION *s, SSL3_RECORD *recs, size_t n_recs, int sending,
255 SSL_MAC_BUF *macs, size_t macsize)
256 {
257 EVP_CIPHER_CTX *ds;
258 size_t reclen[SSL_MAX_PIPELINES];
259 unsigned char buf[SSL_MAX_PIPELINES][EVP_AEAD_TLS1_AAD_LEN];
260 int i, pad = 0, tmpr;
261 size_t bs, ctr, padnum, loop;
262 unsigned char padval;
263 const EVP_CIPHER *enc;
264 int tlstree_enc = (s->mac_flags & SSL_MAC_FLAG_WRITE_MAC_TLSTREE);
265
266 if (n_recs == 0) {
267 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
268 return 0;
269 }
270
271 assert(sending);
272 if (EVP_MD_CTX_get0_md(s->write_hash)) {
273 int n = EVP_MD_CTX_get_size(s->write_hash);
274
275 if (!ossl_assert(n >= 0)) {
276 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
277 return 0;
278 }
279 }
280 ds = s->enc_write_ctx;
281 if (s->enc_write_ctx == NULL)
282 enc = NULL;
283 else {
284 int ivlen;
285
286 enc = EVP_CIPHER_CTX_get0_cipher(s->enc_write_ctx);
287 /* For TLSv1.1 and later explicit IV */
288 if (SSL_USE_EXPLICIT_IV(s)
289 && EVP_CIPHER_get_mode(enc) == EVP_CIPH_CBC_MODE)
290 ivlen = EVP_CIPHER_get_iv_length(enc);
291 else
292 ivlen = 0;
293 if (ivlen > 1) {
294 for (ctr = 0; ctr < n_recs; ctr++) {
295 if (recs[ctr].data != recs[ctr].input) {
296 /*
297 * we can't write into the input stream: Can this ever
298 * happen?? (steve)
299 */
300 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
301 return 0;
302 } else if (RAND_bytes_ex(SSL_CONNECTION_GET_CTX(s)->libctx,
303 recs[ctr].input,
304 ivlen, 0) <= 0) {
305 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
306 return 0;
307 }
308 }
309 }
310 }
311
312 if ((s->session == NULL) || (ds == NULL) || (enc == NULL)) {
313 for (ctr = 0; ctr < n_recs; ctr++) {
314 memmove(recs[ctr].data, recs[ctr].input, recs[ctr].length);
315 recs[ctr].input = recs[ctr].data;
316 }
317 } else {
318 int provided = (EVP_CIPHER_get0_provider(enc) != NULL);
319
320 bs = EVP_CIPHER_get_block_size(EVP_CIPHER_CTX_get0_cipher(ds));
321
322 if (n_recs > 1) {
323 if ((EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(ds))
324 & EVP_CIPH_FLAG_PIPELINE) == 0) {
325 /*
326 * We shouldn't have been called with pipeline data if the
327 * cipher doesn't support pipelining
328 */
329 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_PIPELINE_FAILURE);
330 return 0;
331 }
332 }
333 for (ctr = 0; ctr < n_recs; ctr++) {
334 reclen[ctr] = recs[ctr].length;
335
336 if ((EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(ds))
337 & EVP_CIPH_FLAG_AEAD_CIPHER) != 0) {
338 unsigned char *seq;
339
340 seq = RECORD_LAYER_get_write_sequence(&s->rlayer);
341
342 if (SSL_CONNECTION_IS_DTLS(s)) {
343 /* DTLS does not support pipelining */
344 unsigned char dtlsseq[8], *p = dtlsseq;
345
346 s2n(DTLS_RECORD_LAYER_get_w_epoch(&s->rlayer), p);
347 memcpy(p, &seq[2], 6);
348 memcpy(buf[ctr], dtlsseq, 8);
349 } else {
350 memcpy(buf[ctr], seq, 8);
351 for (i = 7; i >= 0; i--) { /* increment */
352 ++seq[i];
353 if (seq[i] != 0)
354 break;
355 }
356 }
357
358 buf[ctr][8] = recs[ctr].type;
359 buf[ctr][9] = (unsigned char)(s->version >> 8);
360 buf[ctr][10] = (unsigned char)(s->version);
361 buf[ctr][11] = (unsigned char)(recs[ctr].length >> 8);
362 buf[ctr][12] = (unsigned char)(recs[ctr].length & 0xff);
363 pad = EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_AEAD_TLS1_AAD,
364 EVP_AEAD_TLS1_AAD_LEN, buf[ctr]);
365 if (pad <= 0) {
366 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
367 return 0;
368 }
369
370 reclen[ctr] += pad;
371 recs[ctr].length += pad;
372
373 } else if ((bs != 1) && !provided) {
374 /*
375 * We only do this for legacy ciphers. Provided ciphers add the
376 * padding on the provider side.
377 */
378 padnum = bs - (reclen[ctr] % bs);
379
380 /* Add weird padding of up to 256 bytes */
381
382 if (padnum > MAX_PADDING) {
383 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
384 return 0;
385 }
386 /* we need to add 'padnum' padding bytes of value padval */
387 padval = (unsigned char)(padnum - 1);
388 for (loop = reclen[ctr]; loop < reclen[ctr] + padnum; loop++)
389 recs[ctr].input[loop] = padval;
390 reclen[ctr] += padnum;
391 recs[ctr].length += padnum;
392 }
393 }
394 if (n_recs > 1) {
395 unsigned char *data[SSL_MAX_PIPELINES];
396
397 /* Set the output buffers */
398 for (ctr = 0; ctr < n_recs; ctr++) {
399 data[ctr] = recs[ctr].data;
400 }
401 if (EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_SET_PIPELINE_OUTPUT_BUFS,
402 (int)n_recs, data) <= 0) {
403 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_PIPELINE_FAILURE);
404 return 0;
405 }
406 /* Set the input buffers */
407 for (ctr = 0; ctr < n_recs; ctr++) {
408 data[ctr] = recs[ctr].input;
409 }
410 if (EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_SET_PIPELINE_INPUT_BUFS,
411 (int)n_recs, data) <= 0
412 || EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_SET_PIPELINE_INPUT_LENS,
413 (int)n_recs, reclen) <= 0) {
414 SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_PIPELINE_FAILURE);
415 return 0;
416 }
417 }
418
419 if (!SSL_CONNECTION_IS_DTLS(s) && tlstree_enc) {
420 unsigned char *seq;
421 int decrement_seq = 0;
422
423 /*
424 * When sending, seq is incremented after MAC calculation.
425 * So if we are in ETM mode, we use seq 'as is' in the ctrl-function.
426 * Otherwise we have to decrease it in the implementation
427 */
428 if (!SSL_WRITE_ETM(s))
429 decrement_seq = 1;
430
431 seq = RECORD_LAYER_get_write_sequence(&s->rlayer);
432 if (EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_TLSTREE, decrement_seq, seq) <= 0) {
433 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
434 return 0;
435 }
436 }
437
438 if (provided) {
439 int outlen;
440
441 /* Provided cipher - we do not support pipelining on this path */
442 if (n_recs > 1) {
443 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
444 return 0;
445 }
446
447 if (!EVP_CipherUpdate(ds, recs[0].data, &outlen, recs[0].input,
448 (unsigned int)reclen[0]))
449 return 0;
450 recs[0].length = outlen;
451 } else {
452 /* Legacy cipher */
453
454 tmpr = EVP_Cipher(ds, recs[0].data, recs[0].input,
455 (unsigned int)reclen[0]);
456 if ((EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(ds))
457 & EVP_CIPH_FLAG_CUSTOM_CIPHER) != 0
458 ? (tmpr < 0)
459 : (tmpr == 0)) {
460 /* AEAD can fail to verify MAC */
461 return 0;
462 }
463 }
464 }
465 return 1;
466 }
467
n_ssl3_mac(SSL_CONNECTION * sc,SSL3_RECORD * rec,unsigned char * md,int sending)468 int n_ssl3_mac(SSL_CONNECTION *sc, SSL3_RECORD *rec, unsigned char *md,
469 int sending)
470 {
471 unsigned char *mac_sec, *seq;
472 const EVP_MD_CTX *hash;
473 unsigned char *p, rec_char;
474 size_t md_size;
475 size_t npad;
476 int t;
477 unsigned int md_size_u;
478 EVP_MD_CTX *md_ctx;
479
480 /*
481 * All read record layer operations should have been moved to the new
482 * record layer code
483 */
484 assert(sending);
485
486 mac_sec = &(sc->s3.write_mac_secret[0]);
487 seq = RECORD_LAYER_get_write_sequence(&sc->rlayer);
488 hash = sc->write_hash;
489
490 t = EVP_MD_CTX_get_size(hash);
491 if (t < 0)
492 return 0;
493 md_size = t;
494 npad = (48 / md_size) * md_size;
495
496 /* Chop the digest off the end :-) */
497 md_ctx = EVP_MD_CTX_new();
498
499 if (md_ctx == NULL)
500 return 0;
501
502 rec_char = rec->type;
503 p = md;
504 s2n(rec->length, p);
505 if (EVP_MD_CTX_copy_ex(md_ctx, hash) <= 0
506 || EVP_DigestUpdate(md_ctx, mac_sec, md_size) <= 0
507 || EVP_DigestUpdate(md_ctx, ssl3_pad_1, npad) <= 0
508 || EVP_DigestUpdate(md_ctx, seq, 8) <= 0
509 || EVP_DigestUpdate(md_ctx, &rec_char, 1) <= 0
510 || EVP_DigestUpdate(md_ctx, md, 2) <= 0
511 || EVP_DigestUpdate(md_ctx, rec->input, rec->length) <= 0
512 || EVP_DigestFinal_ex(md_ctx, md, NULL) <= 0
513 || EVP_MD_CTX_copy_ex(md_ctx, hash) <= 0
514 || EVP_DigestUpdate(md_ctx, mac_sec, md_size) <= 0
515 || EVP_DigestUpdate(md_ctx, ssl3_pad_2, npad) <= 0
516 || EVP_DigestUpdate(md_ctx, md, md_size) <= 0
517 || EVP_DigestFinal_ex(md_ctx, md, &md_size_u) <= 0) {
518 EVP_MD_CTX_free(md_ctx);
519 return 0;
520 }
521
522 EVP_MD_CTX_free(md_ctx);
523
524 ssl3_record_sequence_update(seq);
525 return 1;
526 }
527
tls1_mac_old(SSL_CONNECTION * sc,SSL3_RECORD * rec,unsigned char * md,int sending)528 int tls1_mac_old(SSL_CONNECTION *sc, SSL3_RECORD *rec, unsigned char *md,
529 int sending)
530 {
531 unsigned char *seq;
532 EVP_MD_CTX *hash;
533 size_t md_size;
534 int i;
535 EVP_MD_CTX *hmac = NULL, *mac_ctx;
536 unsigned char header[13];
537 int stream_mac = (sc->mac_flags & SSL_MAC_FLAG_WRITE_MAC_STREAM);
538 int tlstree_mac = (sc->mac_flags & SSL_MAC_FLAG_WRITE_MAC_TLSTREE);
539 int t;
540 int ret = 0;
541
542 /*
543 * All read record layer calls should have been moved to the new record
544 * layer.
545 */
546 assert(sending);
547
548 seq = RECORD_LAYER_get_write_sequence(&sc->rlayer);
549 hash = sc->write_hash;
550
551 t = EVP_MD_CTX_get_size(hash);
552 if (!ossl_assert(t >= 0))
553 return 0;
554 md_size = t;
555
556 /* I should fix this up TLS TLS TLS TLS TLS XXXXXXXX */
557 if (stream_mac) {
558 mac_ctx = hash;
559 } else {
560 hmac = EVP_MD_CTX_new();
561 if (hmac == NULL || !EVP_MD_CTX_copy(hmac, hash)) {
562 goto end;
563 }
564 mac_ctx = hmac;
565 }
566
567 if (!SSL_CONNECTION_IS_DTLS(sc) && tlstree_mac
568 && EVP_MD_CTX_ctrl(mac_ctx, EVP_MD_CTRL_TLSTREE, 0, seq) <= 0) {
569 goto end;
570 }
571
572 if (SSL_CONNECTION_IS_DTLS(sc)) {
573 unsigned char dtlsseq[8], *p = dtlsseq;
574
575 s2n(DTLS_RECORD_LAYER_get_w_epoch(&sc->rlayer), p);
576 memcpy(p, &seq[2], 6);
577
578 memcpy(header, dtlsseq, 8);
579 } else
580 memcpy(header, seq, 8);
581
582 header[8] = rec->type;
583 header[9] = (unsigned char)(sc->version >> 8);
584 header[10] = (unsigned char)(sc->version);
585 header[11] = (unsigned char)(rec->length >> 8);
586 header[12] = (unsigned char)(rec->length & 0xff);
587
588 if (EVP_DigestSignUpdate(mac_ctx, header, sizeof(header)) <= 0
589 || EVP_DigestSignUpdate(mac_ctx, rec->input, rec->length) <= 0
590 || EVP_DigestSignFinal(mac_ctx, md, &md_size) <= 0) {
591 goto end;
592 }
593
594 OSSL_TRACE_BEGIN(TLS) {
595 BIO_printf(trc_out, "seq:\n");
596 BIO_dump_indent(trc_out, seq, 8, 4);
597 BIO_printf(trc_out, "rec:\n");
598 BIO_dump_indent(trc_out, rec->data, rec->length, 4);
599 } OSSL_TRACE_END(TLS);
600
601 if (!SSL_CONNECTION_IS_DTLS(sc)) {
602 for (i = 7; i >= 0; i--) {
603 ++seq[i];
604 if (seq[i] != 0)
605 break;
606 }
607 }
608 OSSL_TRACE_BEGIN(TLS) {
609 BIO_printf(trc_out, "md:\n");
610 BIO_dump_indent(trc_out, md, md_size, 4);
611 } OSSL_TRACE_END(TLS);
612 ret = 1;
613 end:
614 EVP_MD_CTX_free(hmac);
615 return ret;
616 }
617
