| /* DTLS implementation written by Nagendra Modadugu |
| * (nagendra@cs.stanford.edu) for the OpenSSL project 2005. */ |
| /* ==================================================================== |
| * Copyright (c) 1998-2005 The OpenSSL Project. All rights reserved. |
| * |
| * Redistribution and use in source and binary forms, with or without |
| * modification, are permitted provided that the following conditions |
| * are met: |
| * |
| * 1. Redistributions of source code must retain the above copyright |
| * notice, this list of conditions and the following disclaimer. |
| * |
| * 2. Redistributions in binary form must reproduce the above copyright |
| * notice, this list of conditions and the following disclaimer in |
| * the documentation and/or other materials provided with the |
| * distribution. |
| * |
| * 3. All advertising materials mentioning features or use of this |
| * software must display the following acknowledgment: |
| * "This product includes software developed by the OpenSSL Project |
| * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" |
| * |
| * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to |
| * endorse or promote products derived from this software without |
| * prior written permission. For written permission, please contact |
| * openssl-core@openssl.org. |
| * |
| * 5. Products derived from this software may not be called "OpenSSL" |
| * nor may "OpenSSL" appear in their names without prior written |
| * permission of the OpenSSL Project. |
| * |
| * 6. Redistributions of any form whatsoever must retain the following |
| * acknowledgment: |
| * "This product includes software developed by the OpenSSL Project |
| * for use in the OpenSSL Toolkit (http://www.openssl.org/)" |
| * |
| * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY |
| * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
| * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR |
| * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
| * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
| * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
| * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, |
| * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
| * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED |
| * OF THE POSSIBILITY OF SUCH DAMAGE. |
| * ==================================================================== |
| * |
| * This product includes cryptographic software written by Eric Young |
| * (eay@cryptsoft.com). This product includes software written by Tim |
| * Hudson (tjh@cryptsoft.com). |
| * |
| */ |
| /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| * All rights reserved. |
| * |
| * This package is an SSL implementation written |
| * by Eric Young (eay@cryptsoft.com). |
| * The implementation was written so as to conform with Netscapes SSL. |
| * |
| * This library is free for commercial and non-commercial use as long as |
| * the following conditions are aheared to. The following conditions |
| * apply to all code found in this distribution, be it the RC4, RSA, |
| * lhash, DES, etc., code; not just the SSL code. The SSL documentation |
| * included with this distribution is covered by the same copyright terms |
| * except that the holder is Tim Hudson (tjh@cryptsoft.com). |
| * |
| * Copyright remains Eric Young's, and as such any Copyright notices in |
| * the code are not to be removed. |
| * If this package is used in a product, Eric Young should be given attribution |
| * as the author of the parts of the library used. |
| * This can be in the form of a textual message at program startup or |
| * in documentation (online or textual) provided with the package. |
| * |
| * Redistribution and use in source and binary forms, with or without |
| * modification, are permitted provided that the following conditions |
| * are met: |
| * 1. Redistributions of source code must retain the copyright |
| * notice, this list of conditions and the following disclaimer. |
| * 2. Redistributions in binary form must reproduce the above copyright |
| * notice, this list of conditions and the following disclaimer in the |
| * documentation and/or other materials provided with the distribution. |
| * 3. All advertising materials mentioning features or use of this software |
| * must display the following acknowledgement: |
| * "This product includes cryptographic software written by |
| * Eric Young (eay@cryptsoft.com)" |
| * The word 'cryptographic' can be left out if the rouines from the library |
| * being used are not cryptographic related :-). |
| * 4. If you include any Windows specific code (or a derivative thereof) from |
| * the apps directory (application code) you must include an acknowledgement: |
| * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" |
| * |
| * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND |
| * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE |
| * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
| * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| * SUCH DAMAGE. |
| * |
| * The licence and distribution terms for any publically available version or |
| * derivative of this code cannot be changed. i.e. this code cannot simply be |
| * copied and put under another distribution licence |
| * [including the GNU Public Licence.] */ |
| |
| #include <openssl/ssl.h> |
| |
| #include <assert.h> |
| #include <string.h> |
| |
| #include <openssl/bytestring.h> |
| #include <openssl/err.h> |
| |
| #include "../crypto/internal.h" |
| #include "internal.h" |
| |
| |
| BSSL_NAMESPACE_BEGIN |
| |
| bool DTLSReplayBitmap::ShouldDiscard(uint64_t seq_num) const { |
| const size_t kWindowSize = map_.size(); |
| |
| if (seq_num > max_seq_num_) { |
| return false; |
| } |
| uint64_t idx = max_seq_num_ - seq_num; |
| return idx >= kWindowSize || map_[idx]; |
| } |
| |
| void DTLSReplayBitmap::Record(uint64_t seq_num) { |
| const size_t kWindowSize = map_.size(); |
| |
| // Shift the window if necessary. |
| if (seq_num > max_seq_num_) { |
| uint64_t shift = seq_num - max_seq_num_; |
| if (shift >= kWindowSize) { |
| map_.reset(); |
| } else { |
| map_ <<= shift; |
| } |
| max_seq_num_ = seq_num; |
| } |
| |
| uint64_t idx = max_seq_num_ - seq_num; |
| if (idx < kWindowSize) { |
| map_[idx] = true; |
| } |
| } |
| |
| static uint16_t dtls_record_version(const SSL *ssl) { |
| if (ssl->s3->version == 0) { |
| // Before the version is determined, outgoing records use dTLS 1.0 for |
| // historical compatibility requirements. |
| return DTLS1_VERSION; |
| } |
| // DTLS 1.3 freezes the record version at DTLS 1.2. Previous ones use the |
| // version itself. |
| return ssl_protocol_version(ssl) >= TLS1_3_VERSION ? DTLS1_2_VERSION |
| : ssl->s3->version; |
| } |
| |
| static uint64_t dtls_aead_sequence(const SSL *ssl, DTLSRecordNumber num) { |
| // DTLS 1.3 uses the sequence number with the AEAD, while DTLS 1.2 uses the |
| // combined value. If the version is not known, the epoch is unencrypted and |
| // the value is ignored. |
| return (ssl->s3->version != 0 && ssl_protocol_version(ssl) >= TLS1_3_VERSION) |
| ? num.sequence() |
| : num.combined(); |
| } |
| |
| // reconstruct_epoch finds the largest epoch that ends with the epoch bits from |
| // |wire_epoch| that is less than or equal to |current_epoch|, to match the |
| // epoch reconstruction algorithm described in RFC 9147 section 4.2.2. |
| static uint16_t reconstruct_epoch(uint8_t wire_epoch, uint16_t current_epoch) { |
| uint16_t current_epoch_high = current_epoch & 0xfffc; |
| uint16_t epoch = (wire_epoch & 0x3) | current_epoch_high; |
| if (epoch > current_epoch && current_epoch_high > 0) { |
| epoch -= 0x4; |
| } |
| return epoch; |
| } |
| |
| uint64_t reconstruct_seqnum(uint16_t wire_seq, uint64_t seq_mask, |
| uint64_t max_valid_seqnum) { |
| // Although DTLS 1.3 can support sequence numbers up to 2^64-1, we continue to |
| // enforce the DTLS 1.2 2^48-1 limit. With a minimal DTLS 1.3 record header (2 |
| // bytes), no payload, and 16 byte AEAD overhead, sending 2^48 records would |
| // require 5 petabytes. This allows us to continue to pack a DTLS record |
| // number into an 8-byte structure. |
| assert(max_valid_seqnum <= DTLSRecordNumber::kMaxSequence); |
| assert(seq_mask == 0xff || seq_mask == 0xffff); |
| |
| uint64_t max_seqnum_plus_one = max_valid_seqnum + 1; |
| uint64_t diff = (wire_seq - max_seqnum_plus_one) & seq_mask; |
| uint64_t step = seq_mask + 1; |
| // This addition cannot overflow. It is at most 2^48 + seq_mask. It, however, |
| // may exceed 2^48-1. |
| uint64_t seqnum = max_seqnum_plus_one + diff; |
| bool too_large = seqnum > DTLSRecordNumber::kMaxSequence; |
| // If the diff is larger than half the step size, then the closest seqnum |
| // to max_seqnum_plus_one (in Z_{2^64}) is seqnum minus step instead of |
| // seqnum. |
| bool closer_is_less = diff > step / 2; |
| // Subtracting step from seqnum will cause underflow if seqnum is too small. |
| bool would_underflow = seqnum < step; |
| if (too_large || (closer_is_less && !would_underflow)) { |
| seqnum -= step; |
| } |
| assert(seqnum <= DTLSRecordNumber::kMaxSequence); |
| return seqnum; |
| } |
| |
| static Span<uint8_t> cbs_to_writable_bytes(CBS cbs) { |
| return MakeSpan(const_cast<uint8_t *>(CBS_data(&cbs)), CBS_len(&cbs)); |
| } |
| |
| struct ParsedDTLSRecord { |
| // read_epoch will be null if the record is for an unrecognized epoch. In that |
| // case, |number| may be unset. |
| DTLSReadEpoch *read_epoch = nullptr; |
| DTLSRecordNumber number; |
| CBS header, body; |
| uint8_t type = 0; |
| uint16_t version = 0; |
| }; |
| |
| static bool use_dtls13_record_header(const SSL *ssl, uint16_t epoch) { |
| // Plaintext records in DTLS 1.3 also use the DTLSPlaintext structure for |
| // backwards compatibility. |
| return ssl->s3->version != 0 && ssl_protocol_version(ssl) > TLS1_2_VERSION && |
| epoch > 0; |
| } |
| |
| static bool parse_dtls13_record(SSL *ssl, CBS *in, ParsedDTLSRecord *out) { |
| if (out->type & 0x10) { |
| // Connection ID bit set, which we didn't negotiate. |
| return false; |
| } |
| |
| // TODO(crbug.com/42290594): Add a runner test that performs many |
| // key updates to verify epoch reconstruction works for epochs larger than 3. |
| uint16_t epoch = reconstruct_epoch(out->type, ssl->d1->read_epoch.epoch); |
| size_t seq_len = (out->type & 0x08) ? 2 : 1; |
| CBS seq_bytes; |
| if (!CBS_get_bytes(in, &seq_bytes, seq_len)) { |
| return false; |
| } |
| if (out->type & 0x04) { |
| // 16-bit length present |
| if (!CBS_get_u16_length_prefixed(in, &out->body)) { |
| return false; |
| } |
| } else { |
| // No length present - the remaining contents are the whole packet. |
| // CBS_get_bytes is used here to advance |in| to the end so that future |
| // code that computes the number of consumed bytes functions correctly. |
| BSSL_CHECK(CBS_get_bytes(in, &out->body, CBS_len(in))); |
| } |
| |
| // Look up the corresponding epoch. This header form only matches encrypted |
| // DTLS 1.3 epochs. |
| DTLSReadEpoch *read_epoch = nullptr; |
| if (epoch == ssl->d1->read_epoch.epoch) { |
| read_epoch = &ssl->d1->read_epoch; |
| } else if (ssl->d1->next_read_epoch != nullptr && |
| epoch == ssl->d1->next_read_epoch->epoch) { |
| read_epoch = ssl->d1->next_read_epoch.get(); |
| } |
| if (read_epoch != nullptr && use_dtls13_record_header(ssl, epoch)) { |
| out->read_epoch = read_epoch; |
| |
| // Decrypt and reconstruct the sequence number: |
| uint8_t mask[2]; |
| if (!read_epoch->rn_encrypter->GenerateMask(mask, out->body)) { |
| // GenerateMask most likely failed because the record body was not long |
| // enough. |
| return false; |
| } |
| // Apply the mask to the sequence number in-place. The header (with the |
| // decrypted sequence number bytes) is used as the additional data for the |
| // AEAD function. |
| auto writable_seq = cbs_to_writable_bytes(seq_bytes); |
| uint64_t seq = 0; |
| for (size_t i = 0; i < writable_seq.size(); i++) { |
| writable_seq[i] ^= mask[i]; |
| seq = (seq << 8) | writable_seq[i]; |
| } |
| uint64_t full_seq = reconstruct_seqnum(seq, (1 << (seq_len * 8)) - 1, |
| read_epoch->bitmap.max_seq_num()); |
| out->number = DTLSRecordNumber(epoch, full_seq); |
| } |
| |
| return true; |
| } |
| |
| static bool parse_dtls12_record(SSL *ssl, CBS *in, ParsedDTLSRecord *out) { |
| uint64_t epoch_and_seq; |
| if (!CBS_get_u16(in, &out->version) || // |
| !CBS_get_u64(in, &epoch_and_seq) || |
| !CBS_get_u16_length_prefixed(in, &out->body)) { |
| return false; |
| } |
| out->number = DTLSRecordNumber::FromCombined(epoch_and_seq); |
| |
| uint16_t epoch = out->number.epoch(); |
| bool version_ok; |
| if (epoch == 0) { |
| // Only check the first byte. Enforcing beyond that can prevent decoding |
| // version negotiation failure alerts. |
| version_ok = (out->version >> 8) == DTLS1_VERSION_MAJOR; |
| } else { |
| version_ok = out->version == dtls_record_version(ssl); |
| } |
| if (!version_ok) { |
| return false; |
| } |
| |
| // Look up the corresponding epoch. In DTLS 1.2, we only need to consider one |
| // epoch. |
| if (epoch == ssl->d1->read_epoch.epoch && |
| !use_dtls13_record_header(ssl, epoch)) { |
| out->read_epoch = &ssl->d1->read_epoch; |
| } |
| |
| return true; |
| } |
| |
| static bool parse_dtls_record(SSL *ssl, CBS *cbs, ParsedDTLSRecord *out) { |
| CBS copy = *cbs; |
| if (!CBS_get_u8(cbs, &out->type)) { |
| return false; |
| } |
| |
| bool ok; |
| if ((out->type & 0xe0) == 0x20) { |
| ok = parse_dtls13_record(ssl, cbs, out); |
| } else { |
| ok = parse_dtls12_record(ssl, cbs, out); |
| } |
| if (!ok) { |
| return false; |
| } |
| |
| if (CBS_len(&out->body) > SSL3_RT_MAX_ENCRYPTED_LENGTH) { |
| return false; |
| } |
| |
| size_t header_len = CBS_data(&out->body) - CBS_data(©); |
| BSSL_CHECK(CBS_get_bytes(©, &out->header, header_len)); |
| return true; |
| } |
| |
| enum ssl_open_record_t dtls_open_record(SSL *ssl, uint8_t *out_type, |
| DTLSRecordNumber *out_number, |
| Span<uint8_t> *out, |
| size_t *out_consumed, |
| uint8_t *out_alert, Span<uint8_t> in) { |
| *out_consumed = 0; |
| if (ssl->s3->read_shutdown == ssl_shutdown_close_notify) { |
| return ssl_open_record_close_notify; |
| } |
| |
| if (in.empty()) { |
| return ssl_open_record_partial; |
| } |
| |
| CBS cbs(in); |
| ParsedDTLSRecord record; |
| if (!parse_dtls_record(ssl, &cbs, &record)) { |
| // The record header was incomplete or malformed. Drop the entire packet. |
| *out_consumed = in.size(); |
| return ssl_open_record_discard; |
| } |
| |
| ssl_do_msg_callback(ssl, 0 /* read */, SSL3_RT_HEADER, record.header); |
| |
| if (record.read_epoch == nullptr || |
| record.read_epoch->bitmap.ShouldDiscard(record.number.sequence())) { |
| // Drop this record. It's from an unknown epoch or is a replay. Note that if |
| // the record is from next epoch, it could be buffered for later. For |
| // simplicity, drop it and expect retransmit to handle it later; DTLS must |
| // handle packet loss anyway. |
| *out_consumed = in.size() - CBS_len(&cbs); |
| return ssl_open_record_discard; |
| } |
| |
| // Decrypt the body in-place. |
| if (!record.read_epoch->aead->Open(out, record.type, record.version, |
| dtls_aead_sequence(ssl, record.number), |
| record.header, |
| cbs_to_writable_bytes(record.body))) { |
| // Bad packets are silently dropped in DTLS. See section 4.2.1 of RFC 6347. |
| // Clear the error queue of any errors decryption may have added. Drop the |
| // entire packet as it must not have come from the peer. |
| // |
| // TODO(davidben): This doesn't distinguish malloc failures from encryption |
| // failures. |
| ERR_clear_error(); |
| *out_consumed = in.size() - CBS_len(&cbs); |
| return ssl_open_record_discard; |
| } |
| *out_consumed = in.size() - CBS_len(&cbs); |
| |
| // DTLS 1.3 hides the record type inside the encrypted data. |
| bool has_padding = !record.read_epoch->aead->is_null_cipher() && |
| ssl_protocol_version(ssl) >= TLS1_3_VERSION; |
| // Check the plaintext length. |
| size_t plaintext_limit = SSL3_RT_MAX_PLAIN_LENGTH + (has_padding ? 1 : 0); |
| if (out->size() > plaintext_limit) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DATA_LENGTH_TOO_LONG); |
| *out_alert = SSL_AD_RECORD_OVERFLOW; |
| return ssl_open_record_error; |
| } |
| |
| if (has_padding) { |
| do { |
| if (out->empty()) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC); |
| *out_alert = SSL_AD_DECRYPT_ERROR; |
| return ssl_open_record_error; |
| } |
| record.type = out->back(); |
| *out = out->subspan(0, out->size() - 1); |
| } while (record.type == 0); |
| } |
| |
| record.read_epoch->bitmap.Record(record.number.sequence()); |
| |
| // Once we receive a record from the next epoch, it becomes the current epoch. |
| if (record.read_epoch == ssl->d1->next_read_epoch.get()) { |
| ssl->d1->read_epoch = std::move(*ssl->d1->next_read_epoch); |
| ssl->d1->next_read_epoch = nullptr; |
| } |
| |
| // We do not retain previous epochs, so it is guaranteed records come in at |
| // the "current" epoch. (But the current epoch may be one behind the |
| // handshake.) |
| // |
| // TODO(crbug.com/374890768): In DTLS 1.3, where rekeys may occur |
| // mid-connection, retaining previous epochs would make us more robust to |
| // packet reordering. If we do this, we'll need to take care to not |
| // accidentally accept data at the wrong epoch. |
| assert(record.number.epoch() == ssl->d1->read_epoch.epoch); |
| |
| // TODO(davidben): Limit the number of empty records as in TLS? This is only |
| // useful if we also limit discarded packets. |
| |
| if (record.type == SSL3_RT_ALERT) { |
| return ssl_process_alert(ssl, out_alert, *out); |
| } |
| |
| // Reject application data in epochs that do not allow it. |
| if (record.type == SSL3_RT_APPLICATION_DATA) { |
| bool app_data_allowed; |
| if (ssl->s3->version != 0 && ssl_protocol_version(ssl) >= TLS1_3_VERSION) { |
| // Application data is allowed in 0-RTT (epoch 1) and after the handshake |
| // (3 and up). |
| app_data_allowed = |
| record.number.epoch() == 1 || record.number.epoch() >= 3; |
| } else { |
| // Application data is allowed starting epoch 1. |
| app_data_allowed = record.number.epoch() >= 1; |
| } |
| if (!app_data_allowed) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_RECORD); |
| *out_alert = SSL_AD_UNEXPECTED_MESSAGE; |
| return ssl_open_record_error; |
| } |
| } |
| |
| ssl->s3->warning_alert_count = 0; |
| |
| *out_type = record.type; |
| *out_number = record.number; |
| return ssl_open_record_success; |
| } |
| |
| static DTLSWriteEpoch *get_write_epoch(const SSL *ssl, uint16_t epoch) { |
| if (ssl->d1->write_epoch.epoch() == epoch) { |
| return &ssl->d1->write_epoch; |
| } |
| for (const auto &e : ssl->d1->extra_write_epochs) { |
| if (e->epoch() == epoch) { |
| return e.get(); |
| } |
| } |
| return nullptr; |
| } |
| |
| size_t dtls_record_header_write_len(const SSL *ssl, uint16_t epoch) { |
| if (!use_dtls13_record_header(ssl, epoch)) { |
| return DTLS_PLAINTEXT_RECORD_HEADER_LENGTH; |
| } |
| // The DTLS 1.3 has a variable length record header. We never send Connection |
| // ID, we always send 16-bit sequence numbers, and we send a length. (Length |
| // can be omitted, but only for the last record of a packet. Since we send |
| // multiple records in one packet, it's easier to implement always sending the |
| // length.) |
| return DTLS1_3_RECORD_HEADER_WRITE_LENGTH; |
| } |
| |
| size_t dtls_max_seal_overhead(const SSL *ssl, uint16_t epoch) { |
| DTLSWriteEpoch *write_epoch = get_write_epoch(ssl, epoch); |
| if (write_epoch == nullptr) { |
| return 0; |
| } |
| size_t ret = dtls_record_header_write_len(ssl, epoch) + |
| write_epoch->aead->MaxOverhead(); |
| if (use_dtls13_record_header(ssl, epoch)) { |
| // Add 1 byte for the encrypted record type. |
| ret++; |
| } |
| return ret; |
| } |
| |
| size_t dtls_seal_prefix_len(const SSL *ssl, uint16_t epoch) { |
| DTLSWriteEpoch *write_epoch = get_write_epoch(ssl, epoch); |
| if (write_epoch == nullptr) { |
| return 0; |
| } |
| return dtls_record_header_write_len(ssl, epoch) + |
| write_epoch->aead->ExplicitNonceLen(); |
| } |
| |
| size_t dtls_seal_max_input_len(const SSL *ssl, uint16_t epoch, size_t max_out) { |
| DTLSWriteEpoch *write_epoch = get_write_epoch(ssl, epoch); |
| if (write_epoch == nullptr) { |
| return 0; |
| } |
| size_t header_len = dtls_record_header_write_len(ssl, epoch); |
| if (max_out <= header_len) { |
| return 0; |
| } |
| max_out -= header_len; |
| max_out = write_epoch->aead->MaxSealInputLen(max_out); |
| if (max_out > 0 && use_dtls13_record_header(ssl, epoch)) { |
| // Remove 1 byte for the encrypted record type. |
| max_out--; |
| } |
| return max_out; |
| } |
| |
| bool dtls_seal_record(SSL *ssl, DTLSRecordNumber *out_number, uint8_t *out, |
| size_t *out_len, size_t max_out, uint8_t type, |
| const uint8_t *in, size_t in_len, uint16_t epoch) { |
| const size_t prefix = dtls_seal_prefix_len(ssl, epoch); |
| if (buffers_alias(in, in_len, out, max_out) && |
| (max_out < prefix || out + prefix != in)) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_OUTPUT_ALIASES_INPUT); |
| return false; |
| } |
| |
| // Determine the parameters for the current epoch. |
| DTLSWriteEpoch *write_epoch = get_write_epoch(ssl, epoch); |
| if (write_epoch == nullptr) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); |
| return false; |
| } |
| |
| const size_t record_header_len = dtls_record_header_write_len(ssl, epoch); |
| |
| // Ensure the sequence number update does not overflow. |
| DTLSRecordNumber record_number = write_epoch->next_record; |
| if (!record_number.HasNext()) { |
| OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW); |
| return false; |
| } |
| |
| bool dtls13_header = use_dtls13_record_header(ssl, epoch); |
| uint8_t *extra_in = NULL; |
| size_t extra_in_len = 0; |
| if (dtls13_header) { |
| extra_in = &type; |
| extra_in_len = 1; |
| } |
| |
| size_t ciphertext_len; |
| if (!write_epoch->aead->CiphertextLen(&ciphertext_len, in_len, |
| extra_in_len)) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_RECORD_TOO_LARGE); |
| return false; |
| } |
| if (max_out < record_header_len + ciphertext_len) { |
| OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL); |
| return false; |
| } |
| |
| uint16_t record_version = dtls_record_version(ssl); |
| if (dtls13_header) { |
| // The first byte of the DTLS 1.3 record header has the following format: |
| // 0 1 2 3 4 5 6 7 |
| // +-+-+-+-+-+-+-+-+ |
| // |0|0|1|C|S|L|E E| |
| // +-+-+-+-+-+-+-+-+ |
| // |
| // We set C=0 (no Connection ID), S=1 (16-bit sequence number), L=1 (length |
| // is present), which is a mask of 0x2c. The E E bits are the low-order two |
| // bits of the epoch. |
| // |
| // +-+-+-+-+-+-+-+-+ |
| // |0|0|1|0|1|1|E E| |
| // +-+-+-+-+-+-+-+-+ |
| out[0] = 0x2c | (epoch & 0x3); |
| // We always use a two-byte sequence number. A one-byte sequence number |
| // would require coordinating with the application on ACK feedback to know |
| // that the peer is not too far behind. |
| CRYPTO_store_u16_be(out + 1, write_epoch->next_record.sequence()); |
| // TODO(crbug.com/42290594): When we know the record is last in the packet, |
| // omit the length. |
| CRYPTO_store_u16_be(out + 3, ciphertext_len); |
| } else { |
| out[0] = type; |
| CRYPTO_store_u16_be(out + 1, record_version); |
| CRYPTO_store_u64_be(out + 3, record_number.combined()); |
| CRYPTO_store_u16_be(out + 11, ciphertext_len); |
| } |
| Span<const uint8_t> header = MakeConstSpan(out, record_header_len); |
| |
| |
| if (!write_epoch->aead->SealScatter( |
| out + record_header_len, out + prefix, out + prefix + in_len, type, |
| record_version, dtls_aead_sequence(ssl, record_number), header, in, |
| in_len, extra_in, extra_in_len)) { |
| return false; |
| } |
| |
| // Perform record number encryption (RFC 9147 section 4.2.3). |
| if (dtls13_header) { |
| // Record number encryption uses bytes from the ciphertext as a sample to |
| // generate the mask used for encryption. For simplicity, pass in the whole |
| // ciphertext as the sample - GenerateRecordNumberMask will read only what |
| // it needs (and error if |sample| is too short). |
| Span<const uint8_t> sample = |
| MakeConstSpan(out + record_header_len, ciphertext_len); |
| uint8_t mask[2]; |
| if (!write_epoch->rn_encrypter->GenerateMask(mask, sample)) { |
| return false; |
| } |
| out[1] ^= mask[0]; |
| out[2] ^= mask[1]; |
| } |
| |
| *out_number = record_number; |
| write_epoch->next_record = record_number.Next(); |
| *out_len = record_header_len + ciphertext_len; |
| ssl_do_msg_callback(ssl, 1 /* write */, SSL3_RT_HEADER, header); |
| return true; |
| } |
| |
| BSSL_NAMESPACE_END |