providers/implementations/ciphers/ciphercommon_block.c

   1 /*
   2  * Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <assert.h>
  11 /* For SSL3_VERSION, TLS1_VERSION etc */
  12 #include <openssl/ssl.h>
  13 #include <openssl/rand.h>
  14 #include "internal/constant_time.h"
  15 #include "ciphercommon_local.h"
  16 #include "prov/providercommonerr.h"
  17
  18 /* Functions defined in ssl/tls_pad.c */
  19 int ssl3_cbc_remove_padding_and_mac(size_t *reclen,
  20                                     size_t origreclen,
  21                                     unsigned char *recdata,
  22                                     unsigned char **mac,
  23                                     int *alloced,
  24                                     size_t block_size, size_t mac_size,
  25                                     OSSL_LIB_CTX *libctx);
  26
  27 int tls1_cbc_remove_padding_and_mac(size_t *reclen,
  28                                     size_t origreclen,
  29                                     unsigned char *recdata,
  30                                     unsigned char **mac,
  31                                     int *alloced,
  32                                     size_t block_size, size_t mac_size,
  33                                     int aead,
  34                                     OSSL_LIB_CTX *libctx);
  35
  36 /*
  37  * Fills a single block of buffered data from the input, and returns the amount
  38  * of data remaining in the input that is a multiple of the blocksize. The buffer
  39  * is only filled if it already has some data in it, isn't full already or we
  40  * don't have at least one block in the input.
  41  *
  42  * buf: a buffer of blocksize bytes
  43  * buflen: contains the amount of data already in buf on entry. Updated with the
  44  *         amount of data in buf at the end. On entry *buflen must always be
  45  *         less than the blocksize
  46  * blocksize: size of a block. Must be greater than 0 and a power of 2
  47  * in: pointer to a pointer containing the input data
  48  * inlen: amount of input data available
  49  *
  50  * On return buf is filled with as much data as possible up to a full block,
  51  * *buflen is updated containing the amount of data in buf. *in is updated to
  52  * the new location where input data should be read from, *inlen is updated with
  53  * the remaining amount of data in *in. Returns the largest value <= *inlen
  54  * which is a multiple of the blocksize.
  55  */
  56 size_t fillblock(unsigned char *buf, size_t *buflen, size_t blocksize,
  57                  const unsigned char **in, size_t *inlen)
  58 {
  59     size_t blockmask = ~(blocksize - 1);
  60     size_t bufremain = blocksize - *buflen;
  61
  62     assert(*buflen <= blocksize);
  63     assert(blocksize > 0 && (blocksize & (blocksize - 1)) == 0);
  64
  65     if (*inlen < bufremain)
  66         bufremain = *inlen;
  67     memcpy(buf + *buflen, *in, bufremain);
  68     *in += bufremain;
  69     *inlen -= bufremain;
  70     *buflen += bufremain;
  71
  72     return *inlen & blockmask;
  73 }
  74
  75 /*
  76  * Fills the buffer with trailing data from an encryption/decryption that didn't
  77  * fit into a full block.
  78  */
  79 int trailingdata(unsigned char *buf, size_t *buflen, size_t blocksize,
  80                  const unsigned char **in, size_t *inlen)
  81 {
  82     if (*inlen == 0)
  83         return 1;
  84
  85     if (*buflen + *inlen > blocksize) {
  86         ERR_raise(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR);
  87         return 0;
  88     }
  89
  90     memcpy(buf + *buflen, *in, *inlen);
  91     *buflen += *inlen;
  92     *inlen = 0;
  93
  94     return 1;
  95 }
  96
  97 /* Pad the final block for encryption */
  98 void padblock(unsigned char *buf, size_t *buflen, size_t blocksize)
  99 {
 100     size_t i;
 101     unsigned char pad = (unsigned char)(blocksize - *buflen);
 102
 103     for (i = *buflen; i < blocksize; i++)
 104         buf[i] = pad;
 105 }
 106
 107 int unpadblock(unsigned char *buf, size_t *buflen, size_t blocksize)
 108 {
 109     size_t pad, i;
 110     size_t len = *buflen;
 111
 112     if(len != blocksize) {
 113         ERR_raise(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR);
 114         return 0;
 115     }
 116
 117     /*
 118      * The following assumes that the ciphertext has been authenticated.
 119      * Otherwise it provides a padding oracle.
 120      */
 121     pad = buf[blocksize - 1];
 122     if (pad == 0 || pad > blocksize) {
 123         ERR_raise(ERR_LIB_PROV, PROV_R_BAD_DECRYPT);
 124         return 0;
 125     }
 126     for (i = 0; i < pad; i++) {
 127         if (buf[--len] != pad) {
 128             ERR_raise(ERR_LIB_PROV, PROV_R_BAD_DECRYPT);
 129             return 0;
 130         }
 131     }
 132     *buflen = len;
 133     return 1;
 134 }
 135
 136 /*-
 137  * tlsunpadblock removes the CBC padding from the decrypted, TLS, CBC
 138  * record in constant time. Also removes the MAC from the record in constant
 139  * time.
 140  *
 141  * libctx: Our library context
 142  * tlsversion: The TLS version in use, e.g. SSL3_VERSION, TLS1_VERSION, etc
 143  * buf: The decrypted TLS record data
 144  * buflen: The length of the decrypted TLS record data. Updated with the new
 145  *         length after the padding is removed
 146  * block_size: the block size of the cipher used to encrypt the record.
 147  * mac: Location to store the pointer to the MAC
 148  * alloced: Whether the MAC is stored in a newly allocated buffer, or whether
 149  *          *mac points into *buf
 150  * macsize: the size of the MAC inside the record (or 0 if there isn't one)
 151  * aead: whether this is an aead cipher
 152  * returns:
 153  *   0: (in non-constant time) if the record is publicly invalid.
 154  *   1: (in constant time) Record is publicly valid. If padding is invalid then
 155  *      the mac is random
 156  */
 157 int tlsunpadblock(OSSL_LIB_CTX *libctx, unsigned int tlsversion,
 158                   unsigned char *buf, size_t *buflen, size_t blocksize,
 159                   unsigned char **mac, int *alloced, size_t macsize, int aead)
 160 {
 161     int ret;
 162
 163     switch (tlsversion) {
 164     case SSL3_VERSION:
 165         return ssl3_cbc_remove_padding_and_mac(buflen, *buflen, buf, mac,
 166                                                alloced, blocksize, macsize,
 167                                                libctx);
 168
 169     case TLS1_2_VERSION:
 170     case DTLS1_2_VERSION:
 171     case TLS1_1_VERSION:
 172     case DTLS1_VERSION:
 173     case DTLS1_BAD_VER:
 174         /* Remove the explicit IV */
 175         buf += blocksize;
 176         *buflen -= blocksize;
 177         /* Fall through */
 178     case TLS1_VERSION:
 179         ret = tls1_cbc_remove_padding_and_mac(buflen, *buflen, buf, mac,
 180                                               alloced, blocksize, macsize,
 181                                               aead, libctx);
 182         return ret;
 183
 184     default:
 185         return 0;
 186     }
 187 }