C++-ify SSL_AEAD_CTX.
This adds several utilities as replacements for new and delete and makes
bssl::UniquePtr work with our private types.
Later work can convert more incrementally. I did this one more
aggressively to see how it'd work. Unfortunately, in doing so, I needed
to remove the NULL SSL_AEAD_CTX "method" receiver trick to appease
clang. The null cipher is now represented by a concrete SSL_AEAD_CTX.
The long-lived references to SSL_AEAD_CTX are not yet in types with
constructors, so they still bare Delete rather than UniquePtr for now.
Though this does mean we may be able to move the sequence number into
SSLAEADContext later which is one less object for DTLS to carry around.
Bug: 132
Change-Id: I506b404addafb692055d5709b0ca6d5439a4e6be
Reviewed-on: https://boringssl-review.googlesource.com/18164
Reviewed-by: Adam Langley <agl@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
diff --git a/ssl/internal.h b/ssl/internal.h
index d7a3af8..b09f27d 100644
--- a/ssl/internal.h
+++ b/ssl/internal.h
@@ -148,7 +148,12 @@
#include <openssl/base.h>
+#include <type_traits>
+#include <utility>
+
#include <openssl/aead.h>
+#include <openssl/err.h>
+#include <openssl/mem.h>
#include <openssl/ssl.h>
#include <openssl/stack.h>
@@ -167,6 +172,54 @@
struct SSL_HANDSHAKE;
+/* C++ utilities. */
+
+/* New behaves like |new| but uses |OPENSSL_malloc| for memory allocation. It
+ * returns nullptr on allocation error. It only implements single-object
+ * allocation and not new T[n].
+ *
+ * Note: unlike |new|, this does not support non-public constructors. */
+template <typename T, typename... Args>
+T *New(Args &&... args) {
+ T *t = reinterpret_cast<T *>(OPENSSL_malloc(sizeof(T)));
+ if (t == nullptr) {
+ OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
+ return nullptr;
+ }
+ new (t) T(std::forward<Args>(args)...);
+ return t;
+}
+
+/* Delete behaves like |delete| but uses |OPENSSL_free| to release memory.
+ *
+ * Note: unlike |delete| this does not support non-public destructors. */
+template <typename T>
+void Delete(T *t) {
+ if (t != nullptr) {
+ t->~T();
+ OPENSSL_free(t);
+ }
+}
+
+/* Register all types with non-trivial destructors with |UniquePtr|. Types with
+ * trivial destructors may be C structs which require a |BORINGSSL_MAKE_DELETER|
+ * registration. */
+namespace internal {
+template <typename T>
+struct DeleterImpl<T, typename std::enable_if<
+ !std::is_trivially_destructible<T>::value>::type> {
+ static void Free(T *t) { Delete(t); }
+};
+}
+
+/* MakeUnique behaves like |std::make_unique| but returns nullptr on allocation
+ * error. */
+template <typename T, typename... Args>
+UniquePtr<T> MakeUnique(Args &&... args) {
+ return UniquePtr<T>(New<T>(std::forward<Args>(args)...));
+}
+
+
/* Protocol versions.
*
* Due to DTLS's historical wire version differences and to support multiple
@@ -395,110 +448,118 @@
/* Encryption layer. */
-/* SSL_AEAD_CTX contains information about an AEAD that is being used to encrypt
- * an SSL connection. */
-struct SSL_AEAD_CTX {
- const SSL_CIPHER *cipher;
- EVP_AEAD_CTX ctx;
- /* fixed_nonce contains any bytes of the nonce that are fixed for all
+/* SSLAEADContext contains information about an AEAD that is being used to
+ * encrypt an SSL connection. */
+class SSLAEADContext {
+ public:
+ SSLAEADContext(uint16_t version, const SSL_CIPHER *cipher);
+ ~SSLAEADContext();
+ SSLAEADContext(const SSLAEADContext &&) = delete;
+ SSLAEADContext &operator=(const SSLAEADContext &&) = delete;
+
+ /* CreateNullCipher creates an |SSLAEADContext| for the null cipher. */
+ static UniquePtr<SSLAEADContext> CreateNullCipher();
+
+ /* Create creates an |SSLAEADContext| using the supplied key material. It
+ * returns nullptr on error. Only one of |Open| or |Seal| may be used with the
+ * resulting object, depending on |direction|. |version| is the normalized
+ * protocol version, so DTLS 1.0 is represented as 0x0301, not 0xffef. */
+ static UniquePtr<SSLAEADContext> Create(
+ enum evp_aead_direction_t direction, uint16_t version, int is_dtls,
+ const SSL_CIPHER *cipher, const uint8_t *enc_key, size_t enc_key_len,
+ const uint8_t *mac_key, size_t mac_key_len, const uint8_t *fixed_iv,
+ size_t fixed_iv_len);
+
+ uint16_t version() const { return version_; }
+ const SSL_CIPHER *cipher() const { return cipher_; }
+
+ /* is_null_cipher returns true if this is the null cipher. */
+ bool is_null_cipher() const { return !cipher_; }
+
+ /* ExplicitNonceLen returns the length of the explicit nonce. */
+ size_t ExplicitNonceLen() const;
+
+ /* MaxOverhead returns the maximum overhead of calling |Seal|. */
+ size_t MaxOverhead() const;
+
+ /* MaxSuffixLen returns the maximum suffix length written by |SealScatter|.
+ * |extra_in_len| should equal the argument of the same name passed to
+ * |SealScatter|. */
+ size_t MaxSuffixLen(size_t extra_in_len) const;
+
+ /* Open authenticates and decrypts |in_len| bytes from |in| in-place. On
+ * success, it sets |*out| to the plaintext in |in| and returns true.
+ * Otherwise, it returns false. The output will always be |ExplicitNonceLen|
+ * bytes ahead of |in|. */
+ bool Open(CBS *out, uint8_t type, uint16_t wire_version,
+ const uint8_t seqnum[8], uint8_t *in, size_t in_len);
+
+ /* Seal encrypts and authenticates |in_len| bytes from |in| and writes the
+ * result to |out|. It returns true on success and false on error.
+ *
+ * If |in| and |out| alias then |out| + |ExplicitNonceLen| must be == |in|. */
+ bool Seal(uint8_t *out, size_t *out_len, size_t max_out, uint8_t type,
+ uint16_t wire_version, const uint8_t seqnum[8], const uint8_t *in,
+ size_t in_len);
+
+ /* SealScatter encrypts and authenticates |in_len| bytes from |in| and splits
+ * the result between |out_prefix|, |out| and |out_suffix|. It returns one on
+ * success and zero on error.
+ *
+ * On successful return, exactly |ExplicitNonceLen| bytes are written to
+ * |out_prefix|, |in_len| bytes to |out|, and up to |MaxSuffixLen| bytes to
+ * |out_suffix|. |*out_suffix_len| is set to the actual number of bytes
+ * written to |out_suffix|.
+ *
+ * |extra_in| may point to an additional plaintext buffer. If present,
+ * |extra_in_len| additional bytes are encrypted and authenticated, and the
+ * ciphertext is written to the beginning of |out_suffix|. |MaxSuffixLen|
+ * may be used to size |out_suffix| accordingly.
+ *
+ * If |in| and |out| alias then |out| must be == |in|. Other arguments may not
+ * alias anything. */
+ bool SealScatter(uint8_t *out_prefix, uint8_t *out, uint8_t *out_suffix,
+ size_t *out_suffix_len, size_t max_out_suffix_len,
+ uint8_t type, uint16_t wire_version, const uint8_t seqnum[8],
+ const uint8_t *in, size_t in_len, const uint8_t *extra_in,
+ size_t extra_in_len);
+
+ bool GetIV(const uint8_t **out_iv, size_t *out_iv_len) const;
+
+ private:
+ /* GetAdditionalData writes the additional data into |out| and returns the
+ * number of bytes written. */
+ size_t GetAdditionalData(uint8_t out[13], uint8_t type, uint16_t wire_version,
+ const uint8_t seqnum[8], size_t plaintext_len);
+
+ const SSL_CIPHER *cipher_;
+ ScopedEVP_AEAD_CTX ctx_;
+ /* fixed_nonce_ contains any bytes of the nonce that are fixed for all
* records. */
- uint8_t fixed_nonce[12];
- uint8_t fixed_nonce_len, variable_nonce_len;
- /* version is the protocol version that should be used with this AEAD. */
- uint16_t version;
- /* variable_nonce_included_in_record is non-zero if the variable nonce
+ uint8_t fixed_nonce_[12];
+ uint8_t fixed_nonce_len_ = 0, variable_nonce_len_ = 0;
+ /* version_ is the protocol version that should be used with this AEAD. */
+ uint16_t version_;
+ /* variable_nonce_included_in_record_ is true if the variable nonce
* for a record is included as a prefix before the ciphertext. */
- unsigned variable_nonce_included_in_record : 1;
- /* random_variable_nonce is non-zero if the variable nonce is
+ bool variable_nonce_included_in_record_ : 1;
+ /* random_variable_nonce_ is true if the variable nonce is
* randomly generated, rather than derived from the sequence
* number. */
- unsigned random_variable_nonce : 1;
- /* omit_length_in_ad is non-zero if the length should be omitted in the
+ bool random_variable_nonce_ : 1;
+ /* omit_length_in_ad_ is true if the length should be omitted in the
* AEAD's ad parameter. */
- unsigned omit_length_in_ad : 1;
- /* omit_version_in_ad is non-zero if the version should be omitted
+ bool omit_length_in_ad_ : 1;
+ /* omit_version_in_ad_ is true if the version should be omitted
* in the AEAD's ad parameter. */
- unsigned omit_version_in_ad : 1;
- /* omit_ad is non-zero if the AEAD's ad parameter should be omitted. */
- unsigned omit_ad : 1;
- /* xor_fixed_nonce is non-zero if the fixed nonce should be XOR'd into the
+ bool omit_version_in_ad_ : 1;
+ /* omit_ad_ is true if the AEAD's ad parameter should be omitted. */
+ bool omit_ad_ : 1;
+ /* xor_fixed_nonce_ is true if the fixed nonce should be XOR'd into the
* variable nonce rather than prepended. */
- unsigned xor_fixed_nonce : 1;
+ bool xor_fixed_nonce_ : 1;
};
-/* SSL_AEAD_CTX_new creates a newly-allocated |SSL_AEAD_CTX| using the supplied
- * key material. It returns NULL on error. Only one of |SSL_AEAD_CTX_open| or
- * |SSL_AEAD_CTX_seal| may be used with the resulting object, depending on
- * |direction|. |version| is the normalized protocol version, so DTLS 1.0 is
- * represented as 0x0301, not 0xffef. */
-SSL_AEAD_CTX *SSL_AEAD_CTX_new(enum evp_aead_direction_t direction,
- uint16_t version, int is_dtls,
- const SSL_CIPHER *cipher, const uint8_t *enc_key,
- size_t enc_key_len, const uint8_t *mac_key,
- size_t mac_key_len, const uint8_t *fixed_iv,
- size_t fixed_iv_len);
-
-/* SSL_AEAD_CTX_free frees |ctx|. */
-void SSL_AEAD_CTX_free(SSL_AEAD_CTX *ctx);
-
-/* SSL_AEAD_CTX_explicit_nonce_len returns the length of the explicit nonce for
- * |ctx|, if any. |ctx| may be NULL to denote the null cipher. */
-size_t SSL_AEAD_CTX_explicit_nonce_len(const SSL_AEAD_CTX *ctx);
-
-/* SSL_AEAD_CTX_max_overhead returns the maximum overhead of calling
- * |SSL_AEAD_CTX_seal|. |ctx| may be NULL to denote the null cipher. */
-size_t SSL_AEAD_CTX_max_overhead(const SSL_AEAD_CTX *ctx);
-
-/* SSL_AEAD_CTX_max_suffix_len returns the maximum suffix length written by
- * |SSL_AEAD_CTX_seal_scatter|. |ctx| may be NULL to denote the null cipher.
- * |extra_in_len| should equal the argument of the same name passed to
- * |SSL_AEAD_CTX_seal_scatter|. */
-size_t SSL_AEAD_CTX_max_suffix_len(const SSL_AEAD_CTX *ctx,
- size_t extra_in_len);
-
-/* SSL_AEAD_CTX_open authenticates and decrypts |in_len| bytes from |in|
- * in-place. On success, it sets |*out| to the plaintext in |in| and returns
- * one. Otherwise, it returns zero. |ctx| may be NULL to denote the null cipher.
- * The output will always be |explicit_nonce_len| bytes ahead of |in|. */
-int SSL_AEAD_CTX_open(SSL_AEAD_CTX *ctx, CBS *out, uint8_t type,
- uint16_t wire_version, const uint8_t seqnum[8],
- uint8_t *in, size_t in_len);
-
-/* SSL_AEAD_CTX_seal encrypts and authenticates |in_len| bytes from |in| and
- * writes the result to |out|. It returns one on success and zero on
- * error. |ctx| may be NULL to denote the null cipher.
- *
- * If |in| and |out| alias then |out| + |explicit_nonce_len| must be == |in|. */
-int SSL_AEAD_CTX_seal(SSL_AEAD_CTX *ctx, uint8_t *out, size_t *out_len,
- size_t max_out, uint8_t type, uint16_t wire_version,
- const uint8_t seqnum[8], const uint8_t *in,
- size_t in_len);
-
-/* SSL_AEAD_CTX_seal_scatter encrypts and authenticates |in_len| bytes from |in|
- * and splits the result between |out_prefix|, |out| and |out_suffix|. It
- * returns one on success and zero on error. |ctx| may be NULL to denote the
- * null cipher.
- *
- * On successful return, exactly |SSL_AEAD_CTX_explicit_nonce_len| bytes are
- * written to |out_prefix|, |in_len| bytes to |out|, and up to
- * |SSL_AEAD_CTX_max_suffix_len| bytes to |out_suffix|. |*out_suffix_len| is set
- * to the actual number of bytes written to |out_suffix|.
- *
- * |extra_in| may point to an additional plaintext buffer. If present,
- * |extra_in_len| additional bytes are encrypted and authenticated, and the
- * ciphertext is written to the beginning of |out_suffix|.
- * |SSL_AEAD_CTX_max_suffix_len| may be used to size |out_suffix| accordingly.
- *
- * If |in| and |out| alias then |out| must be == |in|. Other arguments may not
- * alias anything. */
-int SSL_AEAD_CTX_seal_scatter(SSL_AEAD_CTX *aead, uint8_t *out_prefix,
- uint8_t *out, uint8_t *out_suffix,
- size_t *out_suffix_len, size_t max_out_suffix_len,
- uint8_t type, uint16_t wire_version,
- const uint8_t seqnum[8], const uint8_t *in,
- size_t in_len, const uint8_t *extra_in,
- size_t extra_in_len);
-
/* DTLS replay bitmap. */
@@ -1568,14 +1629,14 @@
/* received_flight is called when the handshake has received a flight of
* messages from the peer. */
void (*received_flight)(SSL *ssl);
- /* set_read_state sets |ssl|'s read cipher state to |aead_ctx|. It takes
- * ownership of |aead_ctx|. It returns one on success and zero if changing the
- * read state is forbidden at this point. */
- int (*set_read_state)(SSL *ssl, SSL_AEAD_CTX *aead_ctx);
- /* set_write_state sets |ssl|'s write cipher state to |aead_ctx|. It takes
- * ownership of |aead_ctx|. It returns one on success and zero if changing the
- * write state is forbidden at this point. */
- int (*set_write_state)(SSL *ssl, SSL_AEAD_CTX *aead_ctx);
+ /* set_read_state sets |ssl|'s read cipher state to |aead_ctx|. It returns
+ * one on success and zero if changing the read state is forbidden at this
+ * point. */
+ int (*set_read_state)(SSL *ssl, UniquePtr<SSLAEADContext> aead_ctx);
+ /* set_write_state sets |ssl|'s write cipher state to |aead_ctx|. It returns
+ * one on success and zero if changing the write state is forbidden at this
+ * point. */
+ int (*set_write_state)(SSL *ssl, UniquePtr<SSLAEADContext> aead_ctx);
};
struct SSLX509Method {
@@ -1762,10 +1823,10 @@
uint32_t pending_flight_offset;
/* aead_read_ctx is the current read cipher state. */
- SSL_AEAD_CTX *aead_read_ctx;
+ SSLAEADContext *aead_read_ctx;
/* aead_write_ctx is the current write cipher state. */
- SSL_AEAD_CTX *aead_write_ctx;
+ SSLAEADContext *aead_write_ctx;
/* hs is the handshake state for the current handshake or NULL if there isn't
* one. */
@@ -1896,6 +1957,7 @@
/* save last sequence number for retransmissions */
uint8_t last_write_sequence[8];
+ SSLAEADContext *last_aead_write_ctx;
/* incoming_messages is a ring buffer of incoming handshake messages that have
* yet to be processed. The front of the ring buffer is message number
