/*

 * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.

 *

 * Licensed under the Apache License 2.0 (the "License").  You may not use

 * this file except in compliance with the License.  You can obtain a copy

 * in the file LICENSE in the source distribution or at

 * https://www.openssl.org/source/license.html

 */

#include <assert.h>

/* For SSL3_VERSION, TLS1_VERSION etc */

#include <openssl/prov_ssl.h>

#include <openssl/rand.h>

#include <openssl/proverr.h>

#include "internal/constant_time.h"

#include "ciphercommon_local.h"

/* Functions defined in ssl/tls_pad.c */

int ssl3_cbc_remove_padding_and_mac(size_t *reclen,

                                    size_t origreclen,

                                    unsigned char *recdata,

                                    unsigned char **mac,

                                    int *alloced,

                                    size_t block_size, size_t mac_size,

                                    OSSL_LIB_CTX *libctx);

int tls1_cbc_remove_padding_and_mac(size_t *reclen,

                                    size_t origreclen,

                                    unsigned char *recdata,

                                    unsigned char **mac,

                                    int *alloced,

                                    size_t block_size, size_t mac_size,

                                    int aead,

                                    OSSL_LIB_CTX *libctx);

/*

 * Fills a single block of buffered data from the input, and returns the amount

 * of data remaining in the input that is a multiple of the blocksize. The buffer

 * is only filled if it already has some data in it, isn't full already or we

 * don't have at least one block in the input.

 *

 * buf: a buffer of blocksize bytes

 * buflen: contains the amount of data already in buf on entry. Updated with the

 *         amount of data in buf at the end. On entry *buflen must always be

 *         less than the blocksize

 * blocksize: size of a block. Must be greater than 0 and a power of 2

 * in: pointer to a pointer containing the input data

 * inlen: amount of input data available

 *

 * On return buf is filled with as much data as possible up to a full block,

 * *buflen is updated containing the amount of data in buf. *in is updated to

 * the new location where input data should be read from, *inlen is updated with

 * the remaining amount of data in *in. Returns the largest value <= *inlen

 * which is a multiple of the blocksize.

 */

size_t ossl_cipher_fillblock(unsigned char *buf, size_t *buflen,

                             size_t blocksize,

                             const unsigned char **in, size_t *inlen)

{

    size_t blockmask = ~(blocksize - 1);

    size_t bufremain = blocksize - *buflen;

    assert(*buflen <= blocksize);

    assert(blocksize > 0 && (blocksize & (blocksize - 1)) == 0);

    if (*inlen < bufremain)

        bufremain = *inlen;

    memcpy(buf + *buflen, *in, bufremain);

    *in += bufremain;

    *inlen -= bufremain;

    *buflen += bufremain;

    return *inlen & blockmask;

}

/*

 * Fills the buffer with trailing data from an encryption/decryption that didn't

 * fit into a full block.

 */

int ossl_cipher_trailingdata(unsigned char *buf, size_t *buflen, size_t blocksize,

                             const unsigned char **in, size_t *inlen)

{

    if (*inlen == 0)

        return 1;

    if (*buflen + *inlen > blocksize) {

        ERR_raise(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR);

        return 0;

    }

    memcpy(buf + *buflen, *in, *inlen);

    *buflen += *inlen;

    *inlen = 0;

    return 1;

}

/* Pad the final block for encryption */

void ossl_cipher_padblock(unsigned char *buf, size_t *buflen, size_t blocksize)

{

    size_t i;

    unsigned char pad = (unsigned char)(blocksize - *buflen);

    for (i = *buflen; i < blocksize; i++)

        buf[i] = pad;

}

int ossl_cipher_unpadblock(unsigned char *buf, size_t *buflen, size_t blocksize)

{

    size_t pad, i;

    size_t len = *buflen;

    if(len != blocksize) {

        ERR_raise(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR);

        return 0;

    }

    /*

     * The following assumes that the ciphertext has been authenticated.

     * Otherwise it provides a padding oracle.

     */

    pad = buf[blocksize - 1];

    if (pad == 0 || pad > blocksize) {

        ERR_raise(ERR_LIB_PROV, PROV_R_BAD_DECRYPT);

        return 0;

    }

    for (i = 0; i < pad; i++) {

        if (buf[--len] != pad) {

            ERR_raise(ERR_LIB_PROV, PROV_R_BAD_DECRYPT);

            return 0;

        }

    }

    *buflen = len;

    return 1;

}

/*-

 * ossl_cipher_tlsunpadblock removes the CBC padding from the decrypted, TLS, CBC

 * record in constant time. Also removes the MAC from the record in constant

 * time.

 *

 * libctx: Our library context

 * tlsversion: The TLS version in use, e.g. SSL3_VERSION, TLS1_VERSION, etc

 * buf: The decrypted TLS record data

 * buflen: The length of the decrypted TLS record data. Updated with the new

 *         length after the padding is removed

 * block_size: the block size of the cipher used to encrypt the record.

 * mac: Location to store the pointer to the MAC

 * alloced: Whether the MAC is stored in a newly allocated buffer, or whether

 *          *mac points into *buf

 * macsize: the size of the MAC inside the record (or 0 if there isn't one)

 * aead: whether this is an aead cipher

 * returns:

 *   0: (in non-constant time) if the record is publicly invalid.

 *   1: (in constant time) Record is publicly valid. If padding is invalid then

 *      the mac is random

 */

int ossl_cipher_tlsunpadblock(OSSL_LIB_CTX *libctx, unsigned int tlsversion,

                              unsigned char *buf, size_t *buflen,

                              size_t blocksize,

                              unsigned char **mac, int *alloced, size_t macsize,

                              int aead)

{

    int ret;

    switch (tlsversion) {

    case SSL3_VERSION:

        return ssl3_cbc_remove_padding_and_mac(buflen, *buflen, buf, mac,

                                               alloced, blocksize, macsize,

                                               libctx);

    case TLS1_2_VERSION:

    case DTLS1_2_VERSION:

    case TLS1_1_VERSION:

    case DTLS1_VERSION:

    case DTLS1_BAD_VER:

        /* Remove the explicit IV */

        buf += blocksize;

        *buflen -= blocksize;

        /* Fall through */

    case TLS1_VERSION:

        ret = tls1_cbc_remove_padding_and_mac(buflen, *buflen, buf, mac,

                                              alloced, blocksize, macsize,

                                              aead, libctx);

        return ret;

    default:

        return 0;

    }

}