/*

 * Copyright (C) 2000-2013 Free Software Foundation, Inc.

 * Copyright (C) 2013 Nikos Mavrogiannopoulos

 * Copyright (C) 2017-2018 Red Hat, Inc.

 *

 * Author: Nikos Mavrogiannopoulos

 *

 * This file is part of GnuTLS.

 *

 * The GnuTLS is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public License

 * as published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>

 *

 */

/* Some high level functions to be used in the record encryption are

 * included here.

 */

#include "gnutls_int.h"

#include "errors.h"

#include "cipher.h"

#include "algorithms.h"

#include "hash_int.h"

#include "cipher_int.h"

#include "debug.h"

#include "num.h"

#include "datum.h"

#include "kx.h"

#include "record.h"

#include "constate.h"

#include "mbuffers.h"

#include "state.h"

#include "random.h"

#include <nettle/memxor.h>

static int encrypt_packet(gnutls_session_t session, uint8_t *cipher_data,

        int cipher_size, gnutls_datum_t *plain,

        size_t min_pad, content_type_t _type,

        record_parameters_st *params);

static int decrypt_packet(gnutls_session_t session, gnutls_datum_t *ciphertext,

        gnutls_datum_t *plain, content_type_t type,

        record_parameters_st *params, uint64_t sequence);

static int decrypt_packet_tls13(gnutls_session_t session,

        gnutls_datum_t *ciphertext,

        gnutls_datum_t *plain, content_type_t *type,

        record_parameters_st *params,

        uint64_t sequence);

static int encrypt_packet_tls13(gnutls_session_t session, uint8_t *cipher_data,

        size_t cipher_size, gnutls_datum_t *plain,

        size_t pad_size, uint8_t type,

        record_parameters_st *params);

/* returns ciphertext which contains the headers too. This also

 * calculates the size in the header field.

 *

 */

int _gnutls_encrypt(gnutls_session_t session, const uint8_t *data,

        size_t data_size, size_t min_pad, mbuffer_st *bufel,

        content_type_t type, record_parameters_st *params)

{

  gnutls_datum_t plaintext;

  const version_entry_st *vers =

    (session->internals.hsk_flags & HSK_EARLY_DATA_IN_FLIGHT) &&

        !IS_SERVER(session) ?

      session->internals.resumed_security_parameters.pversion :

      get_version(session);

  int ret;

  plaintext.data = (uint8_t *)data;

  plaintext.size = data_size;

  if (vers && vers->tls13_sem) {

    /* it fills the header, as it is included in the authenticated

     * data of the AEAD cipher. */

    ret = encrypt_packet_tls13(session,

             _mbuffer_get_udata_ptr(bufel),

             _mbuffer_get_udata_size(bufel),

             &plaintext, min_pad, type, params);

    if (ret < 0)

      return gnutls_assert_val(ret);

  } else {

    ret = encrypt_packet(session, _mbuffer_get_udata_ptr(bufel),

             _mbuffer_get_udata_size(bufel), &plaintext,

             min_pad, type, params);

    if (ret < 0)

      return gnutls_assert_val(ret);

  }

  if (IS_DTLS(session))

    _gnutls_write_uint16(

      ret, ((uint8_t *)_mbuffer_get_uhead_ptr(bufel)) + 11);

  else

    _gnutls_write_uint16(

      ret, ((uint8_t *)_mbuffer_get_uhead_ptr(bufel)) + 3);

  _mbuffer_set_udata_size(bufel, ret);

  _mbuffer_set_uhead_size(bufel, 0);

  return _mbuffer_get_udata_size(bufel);

}

/* Decrypts the given data.

 * Returns the decrypted data length.

 *

 * The output is preallocated with the maximum allowed data size.

 */

int _gnutls_decrypt(gnutls_session_t session, gnutls_datum_t *ciphertext,

        gnutls_datum_t *output, content_type_t *type,

        record_parameters_st *params, uint64_t sequence)

{

  int ret;

  const version_entry_st *vers = get_version(session);

  if (ciphertext->size == 0)

    return 0;

  if (vers && vers->tls13_sem)

    ret = decrypt_packet_tls13(session, ciphertext, output, type,

             params, sequence);

  else

    ret = decrypt_packet(session, ciphertext, output, *type, params,

             sequence);

  if (ret < 0)

    return gnutls_assert_val(ret);

  return ret;

}

inline static int calc_enc_length_block(gnutls_session_t session,

          const version_entry_st *ver,

          int data_size, int hash_size,

          uint8_t *pad, unsigned auth_cipher,

          uint16_t blocksize, unsigned etm)

{

  /* pad is the LH pad the user wants us to add. Besides

   * this LH pad, we only add minimal padding

   */

  unsigned int pre_length = data_size + *pad;

  unsigned int length, new_pad;

  if (etm == 0)

    pre_length += hash_size;

  new_pad = (uint8_t)(blocksize - (pre_length % blocksize)) + *pad;

  if (new_pad > 255)

    new_pad -= blocksize;

  *pad = new_pad;

  length = data_size + hash_size + *pad;

  if (_gnutls_version_has_explicit_iv(ver))

    length += blocksize; /* for the IV */

  return length;

}

inline static int calc_enc_length_stream(gnutls_session_t session,

           int data_size, int hash_size,

           unsigned auth_cipher,

           unsigned exp_iv_size)

{

  unsigned int length;

  length = data_size + hash_size;

  if (auth_cipher)

    length += exp_iv_size;

  return length;

}

/* generates the authentication data (data to be hashed only

 * and are not to be sent). Returns their size.

 */

int _gnutls_make_preamble(uint64_t uint64_data, uint8_t type,

        unsigned int length, const version_entry_st *ver,

        uint8_t preamble[MAX_PREAMBLE_SIZE])

{

  uint8_t *p = preamble;

  uint16_t c_length;

  c_length = _gnutls_conv_uint16(length);

  _gnutls_write_uint64(uint64_data, p);

  p += 8;

  *p = type;

  p++;

#ifdef ENABLE_SSL3

  if (ver->id != GNUTLS_SSL3)

#endif

  { /* TLS protocols */

    *p = ver->major;

    p++;

    *p = ver->minor;

    p++;

  }

  memcpy(p, &c_length, 2);

  p += 2;

  return p - preamble;

}

/* This is the actual encryption

 * Encrypts the given plaintext datum, and puts the result to cipher_data,

 * which has cipher_size size.

 * return the actual encrypted data length.

 */

static int encrypt_packet(gnutls_session_t session, uint8_t *cipher_data,

        int cipher_size, gnutls_datum_t *plain,

        size_t min_pad, content_type_t type,

        record_parameters_st *params)

{

  uint8_t pad;

  int length, ret;

  uint8_t preamble[MAX_PREAMBLE_SIZE];

  int preamble_size;

  int tag_size = _gnutls_auth_cipher_tag_len(&params->write.ctx.tls12);

  int blocksize = _gnutls_cipher_get_block_size(params->cipher);

  unsigned algo_type = _gnutls_cipher_type(params->cipher);

  uint8_t *data_ptr, *full_cipher_ptr;

  const version_entry_st *ver = get_version(session);

  int explicit_iv = _gnutls_version_has_explicit_iv(ver);

  int auth_cipher = _gnutls_auth_cipher_is_aead(&params->write.ctx.tls12);

  uint8_t nonce[MAX_CIPHER_IV_SIZE];

  unsigned imp_iv_size = 0, exp_iv_size = 0;

  bool etm = 0;

  if (unlikely(ver == NULL))

    return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

  if (algo_type == CIPHER_BLOCK && params->etm != 0)

    etm = 1;

  _gnutls_hard_log("ENC[%p]: cipher: %s, MAC: %s, Epoch: %u\n", session,

       _gnutls_cipher_get_name(params->cipher),

       _gnutls_mac_get_name(params->mac),

       (unsigned int)params->epoch);

  /* Calculate the encrypted length (padding etc.)

   */

  if (algo_type == CIPHER_BLOCK) {

    /* Call gnutls_rnd() once. Get data used for the IV

     */

    ret = gnutls_rnd(GNUTLS_RND_NONCE, nonce, blocksize);

    if (ret < 0)

      return gnutls_assert_val(ret);

    pad = min_pad;

    length = calc_enc_length_block(session, ver, plain->size,

                 tag_size, &pad, auth_cipher,

                 blocksize, etm);

  } else { /* AEAD + STREAM */

    imp_iv_size =

      _gnutls_cipher_get_implicit_iv_size(params->cipher);

    exp_iv_size =

      _gnutls_cipher_get_explicit_iv_size(params->cipher);

    pad = 0;

    length = calc_enc_length_stream(session, plain->size, tag_size,

            auth_cipher, exp_iv_size);

  }

  if (length < 0)

    return gnutls_assert_val(length);

  /* copy the encrypted data to cipher_data.

   */

  if (cipher_size < length)

    return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

  data_ptr = cipher_data;

  full_cipher_ptr = data_ptr;

  if (algo_type == CIPHER_BLOCK || algo_type == CIPHER_STREAM) {

    if (algo_type == CIPHER_BLOCK && explicit_iv != 0) {

      /* copy the random IV.

       */

      memcpy(data_ptr, nonce, blocksize);

      ret = _gnutls_auth_cipher_setiv(

        &params->write.ctx.tls12, data_ptr, blocksize);

      if (ret < 0)

        return gnutls_assert_val(ret);

      /*data_ptr += blocksize; */

      cipher_data += blocksize;

    }

  } else { /* AEAD */

    if ((params->cipher->flags & GNUTLS_CIPHER_FLAG_XOR_NONCE) ==

        0) {

      /* Values in AEAD are pretty fixed in TLS 1.2 for 128-bit block

       */

      if (params->write.iv_size != imp_iv_size)

        return gnutls_assert_val(

          GNUTLS_E_INTERNAL_ERROR);

      /* Instead of generating a new nonce on every packet, we use the

       * write.sequence_number (It is a MAY on RFC 5288), and safer

       * as it will never reuse a value.

       */

      memcpy(nonce, params->write.iv, params->write.iv_size);

      _gnutls_write_uint64(params->write.sequence_number,

               &nonce[imp_iv_size]);

      memcpy(data_ptr, &nonce[imp_iv_size], exp_iv_size);

      /*data_ptr += exp_iv_size; */

      cipher_data += exp_iv_size;

    } else { /* XOR nonce with IV */

      if (unlikely(params->write.iv_size != 12 ||

             imp_iv_size != 12 || exp_iv_size != 0))

        return gnutls_assert_val(

          GNUTLS_E_INTERNAL_ERROR);

      memset(nonce, 0, 4);

      _gnutls_write_uint64(params->write.sequence_number,

               &nonce[4]);

      memxor(nonce, params->write.iv, 12);

    }

  }

  if (etm)

    ret = length - tag_size;

  else

    ret = plain->size;

  preamble_size = _gnutls_make_preamble(params->write.sequence_number,

                type, ret, ver, preamble);

  if (algo_type == CIPHER_BLOCK || algo_type == CIPHER_STREAM) {

    /* add the authenticated data */

    ret = _gnutls_auth_cipher_add_auth(&params->write.ctx.tls12,

               preamble, preamble_size);

    if (ret < 0)

      return gnutls_assert_val(ret);

    if (etm && explicit_iv) {

      /* In EtM we need to hash the IV as well */

      ret = _gnutls_auth_cipher_add_auth(

        &params->write.ctx.tls12, full_cipher_ptr,

        blocksize);

      if (ret < 0)

        return gnutls_assert_val(ret);

    }

    /* Actual encryption.

     */

    ret = _gnutls_auth_cipher_encrypt2_tag(&params->write.ctx.tls12,

                   plain->data, plain->size,

                   cipher_data, cipher_size,

                   pad);

    if (ret < 0)

      return gnutls_assert_val(ret);

  } else { /* AEAD */

    ret = _gnutls_aead_cipher_encrypt(

      &params->write.ctx.tls12.cipher, nonce,

      imp_iv_size + exp_iv_size, preamble, preamble_size,

      tag_size, plain->data, plain->size, cipher_data,

      cipher_size);

    if (ret < 0)

      return gnutls_assert_val(ret);

  }

  return length;

}

static int encrypt_packet_tls13(gnutls_session_t session, uint8_t *cipher_data,

        size_t cipher_size, gnutls_datum_t *plain,

        size_t pad_size, uint8_t type,

        record_parameters_st *params)

{

  int ret;

  unsigned int tag_size = params->write.aead_tag_size;

  const version_entry_st *ver = get_version(session);

  uint8_t nonce[MAX_CIPHER_IV_SIZE];

  unsigned iv_size = 0;

  ssize_t max, total;

  uint8_t aad[5];

  giovec_t auth_iov[1];

  giovec_t iov[2];

  if (unlikely(ver == NULL))

    return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

  _gnutls_hard_log("ENC[%p]: cipher: %s, MAC: %s, Epoch: %u\n", session,

       _gnutls_cipher_get_name(params->cipher),

       _gnutls_mac_get_name(params->mac),

       (unsigned int)params->epoch);

  iv_size = params->write.iv_size;

  if (params->cipher->id == GNUTLS_CIPHER_NULL) {

    if (cipher_size < plain->size + 1)

      return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

    memcpy(cipher_data, plain->data, plain->size);

    return plain->size;

  }

  if (unlikely(iv_size < 8))

    return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

  memset(nonce, 0, iv_size - 8);

  _gnutls_write_uint64(params->write.sequence_number,

           &nonce[iv_size - 8]);

  memxor(nonce, params->write.iv, iv_size);

  max = max_record_send_size(session) + MAX_RECORD_SEND_OVERHEAD(session);

  /* make TLS 1.3 form of data */

  total = plain->size + 1 + pad_size;

  /* check whether padding would exceed max */

  if (total > max) {

    if (unlikely(max < (ssize_t)plain->size + 1))

      return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

    pad_size = max - plain->size - 1;

    total = max;

  }

  /* create authenticated data header */

  aad[0] = GNUTLS_APPLICATION_DATA;

  aad[1] = 0x03;

  aad[2] = 0x03;

  _gnutls_write_uint16(total + tag_size, &aad[3]);

  auth_iov[0].iov_base = aad;

  auth_iov[0].iov_len = sizeof(aad);

  iov[0].iov_base = plain->data;

  iov[0].iov_len = plain->size;

  if (pad_size ||

      (session->internals.flags & GNUTLS_SAFE_PADDING_CHECK)) {

    uint8_t *pad = gnutls_calloc(1, 1 + pad_size);

    if (pad == NULL)

      return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);

    pad[0] = type;

    iov[1].iov_base = pad;

    iov[1].iov_len = 1 + pad_size;

    ret = gnutls_aead_cipher_encryptv(&params->write.ctx.aead,

              nonce, iv_size, auth_iov, 1,

              tag_size, iov, 2, cipher_data,

              &cipher_size);

    gnutls_free(pad);

  } else {

    iov[1].iov_base = &type;

    iov[1].iov_len = 1;

    ret = gnutls_aead_cipher_encryptv(&params->write.ctx.aead,

              nonce, iv_size, auth_iov, 1,

              tag_size, iov, 2, cipher_data,

              &cipher_size);

  }

  if (ret < 0)

    return gnutls_assert_val(ret);

  return cipher_size;

}

/* Deciphers the ciphertext packet, and puts the result to plain.

 * Returns the actual plaintext packet size.

 */

static int decrypt_packet(gnutls_session_t session, gnutls_datum_t *ciphertext,

        gnutls_datum_t *plain, content_type_t type,

        record_parameters_st *params, uint64_t sequence)

{

  uint8_t tag[MAX_HASH_SIZE];

  uint8_t nonce[MAX_CIPHER_IV_SIZE];

  const uint8_t *tag_ptr = NULL;

  unsigned int pad = 0;

  int length, length_to_decrypt;

  uint16_t blocksize;

  int ret;

  uint8_t preamble[MAX_PREAMBLE_SIZE];

  unsigned int preamble_size = 0;

  const version_entry_st *ver = get_version(session);

  unsigned int tag_size =

    _gnutls_auth_cipher_tag_len(&params->read.ctx.tls12);

  unsigned int explicit_iv = _gnutls_version_has_explicit_iv(ver);

  unsigned imp_iv_size, exp_iv_size;

  unsigned cipher_type = _gnutls_cipher_type(params->cipher);

  bool etm = 0;

  if (unlikely(ver == NULL))

    return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

  imp_iv_size = _gnutls_cipher_get_implicit_iv_size(params->cipher);

  exp_iv_size = _gnutls_cipher_get_explicit_iv_size(params->cipher);

  blocksize = _gnutls_cipher_get_block_size(params->cipher);

  if (params->etm != 0 && cipher_type == CIPHER_BLOCK)

    etm = 1;

  /* if EtM mode and not AEAD */

  if (etm) {

    if (unlikely(ciphertext->size < tag_size))

      return gnutls_assert_val(

        GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

    preamble_size = _gnutls_make_preamble(

      sequence, type, ciphertext->size - tag_size, ver,

      preamble);

    ret = _gnutls_auth_cipher_add_auth(&params->read.ctx.tls12,

               preamble, preamble_size);

    if (unlikely(ret < 0))

      return gnutls_assert_val(ret);

    ret = _gnutls_auth_cipher_add_auth(&params->read.ctx.tls12,

               ciphertext->data,

               ciphertext->size - tag_size);

    if (unlikely(ret < 0))

      return gnutls_assert_val(ret);

    ret = _gnutls_auth_cipher_tag(&params->read.ctx.tls12, tag,

                tag_size);

    if (unlikely(ret < 0))

      return gnutls_assert_val(ret);

    if (unlikely(gnutls_memcmp(tag,

             &ciphertext->data[ciphertext->size -

                   tag_size],

             tag_size) != 0)) {

      /* HMAC was not the same. */

      return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

    }

  }

  /* actual decryption (inplace)

   */

  switch (cipher_type) {

  case CIPHER_AEAD:

    /* The way AEAD ciphers are defined in RFC5246, it allows

     * only stream ciphers.

     */

    if (unlikely(_gnutls_auth_cipher_is_aead(

             &params->read.ctx.tls12) == 0))

      return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

    if (unlikely(ciphertext->size < (tag_size + exp_iv_size)))

      return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

    if ((params->cipher->flags & GNUTLS_CIPHER_FLAG_XOR_NONCE) ==

        0) {

      /* Values in AEAD are pretty fixed in TLS 1.2 for 128-bit block

       */

      if (unlikely(params->read.iv_size != 4))

        return gnutls_assert_val(

          GNUTLS_E_DECRYPTION_FAILED);

      memcpy(nonce, params->read.iv, imp_iv_size);

      memcpy(&nonce[imp_iv_size], ciphertext->data,

             exp_iv_size);

      ciphertext->data += exp_iv_size;

      ciphertext->size -= exp_iv_size;

    } else { /* XOR nonce with IV */

      if (unlikely(params->read.iv_size != 12 ||

             imp_iv_size != 12 || exp_iv_size != 0))

        return gnutls_assert_val(

          GNUTLS_E_DECRYPTION_FAILED);

      memset(nonce, 0, 4);

      _gnutls_write_uint64(sequence, &nonce[4]);

      memxor(nonce, params->read.iv, 12);

    }

    length = ciphertext->size - tag_size;

    length_to_decrypt = ciphertext->size;

    /* Pass the type, version, length and plain through

     * MAC.

     */

    preamble_size = _gnutls_make_preamble(sequence, type, length,

                  ver, preamble);

    if (unlikely((unsigned)length_to_decrypt > plain->size)) {

      _gnutls_audit_log(

        session,

        "Received %u bytes, while expecting less than %u\n",

        (unsigned int)length_to_decrypt,

        (unsigned int)plain->size);

      return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

    }

    ret = _gnutls_aead_cipher_decrypt(

      &params->read.ctx.tls12.cipher, nonce,

      exp_iv_size + imp_iv_size, preamble, preamble_size,

      tag_size, ciphertext->data, length_to_decrypt,

      plain->data, plain->size);

    if (unlikely(ret < 0))

      return gnutls_assert_val(ret);

    return length;

    break;

  case CIPHER_STREAM:

    if (unlikely(ciphertext->size < tag_size))

      return gnutls_assert_val(

        GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

    length_to_decrypt = ciphertext->size;

    length = ciphertext->size - tag_size;

    tag_ptr = plain->data + length;

    /* Pass the type, version, length and plain through

     * MAC.

     */

    preamble_size = _gnutls_make_preamble(sequence, type, length,

                  ver, preamble);

    ret = _gnutls_auth_cipher_add_auth(&params->read.ctx.tls12,

               preamble, preamble_size);

    if (unlikely(ret < 0))

      return gnutls_assert_val(ret);

    if (unlikely((unsigned)length_to_decrypt > plain->size)) {

      _gnutls_audit_log(

        session,

        "Received %u bytes, while expecting less than %u\n",

        (unsigned int)length_to_decrypt,

        (unsigned int)plain->size);

      return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

    }

    ret = _gnutls_auth_cipher_decrypt2(&params->read.ctx.tls12,

               ciphertext->data,

               length_to_decrypt,

               plain->data, plain->size);

    if (unlikely(ret < 0))

      return gnutls_assert_val(ret);

    ret = _gnutls_auth_cipher_tag(&params->read.ctx.tls12, tag,

                tag_size);

    if (unlikely(ret < 0))

      return gnutls_assert_val(ret);

    if (unlikely(gnutls_memcmp(tag, tag_ptr, tag_size) != 0)) {

      return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

    }

    break;

  case CIPHER_BLOCK:

    if (unlikely(ciphertext->size < blocksize))

      return gnutls_assert_val(

        GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

    if (etm == 0) {

      if (unlikely(ciphertext->size % blocksize != 0))

        return gnutls_assert_val(

          GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

    } else {

      if (unlikely((ciphertext->size - tag_size) %

               blocksize !=

             0))

        return gnutls_assert_val(

          GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

    }

    /* ignore the IV in TLS 1.1+

     */

    if (explicit_iv) {

      ret = _gnutls_auth_cipher_setiv(&params->read.ctx.tls12,

              ciphertext->data,

              blocksize);

      if (ret < 0)

        return gnutls_assert_val(ret);

      memcpy(nonce, ciphertext->data, blocksize);

      ciphertext->size -= blocksize;

      ciphertext->data += blocksize;

    }

    if (unlikely(ciphertext->size < tag_size + 1))

      return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

    /* we don't use the auth_cipher interface here, since

     * TLS with block ciphers is impossible to be used under such

     * an API. (the length of plaintext is required to calculate

     * auth_data, but it is not available before decryption).

     */

    if (unlikely(ciphertext->size > plain->size))

      return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

    if (etm == 0) {

      ret = _gnutls_cipher_decrypt2(

        &params->read.ctx.tls12.cipher,

        ciphertext->data, ciphertext->size, plain->data,

        plain->size);

      if (unlikely(ret < 0))

        return gnutls_assert_val(ret);

      ret = cbc_mac_verify(session, params, preamble, type,

               sequence, plain->data,

               ciphertext->size, tag_size);

      if (unlikely(ret < 0))

        return gnutls_assert_val(ret);

      length = ret;

    } else { /* EtM */

      ret = _gnutls_cipher_decrypt2(

        &params->read.ctx.tls12.cipher,

        ciphertext->data, ciphertext->size - tag_size,

        plain->data, plain->size);

      if (unlikely(ret < 0))

        return gnutls_assert_val(ret);

      pad = plain->data[ciphertext->size - tag_size -

            1]; /* pad */

      length = ciphertext->size - tag_size - pad - 1;

      if (unlikely(length < 0))

        return gnutls_assert_val(

          GNUTLS_E_DECRYPTION_FAILED);

    }

    break;

  default:

    return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

  }

  return length;

}

static int decrypt_packet_tls13(gnutls_session_t session,

        gnutls_datum_t *ciphertext,

        gnutls_datum_t *plain, content_type_t *type,

        record_parameters_st *params, uint64_t sequence)

{

  uint8_t nonce[MAX_CIPHER_IV_SIZE];

  size_t length, length_to_decrypt;

  int ret;

  const version_entry_st *ver = get_version(session);

  unsigned int tag_size = params->read.aead_tag_size;

  unsigned iv_size;

  unsigned j;

  volatile unsigned length_set;

  uint8_t aad[5];

  if (unlikely(ver == NULL))

    return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

  if (params->cipher->id == GNUTLS_CIPHER_NULL) {

    if (plain->size < ciphertext->size)

      return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

    length = ciphertext->size;

    memcpy(plain->data, ciphertext->data, length);

    return length;

  }

  iv_size = _gnutls_cipher_get_iv_size(params->cipher);

  /* The way AEAD ciphers are defined in RFC5246, it allows

   * only stream ciphers.

   */

  if (unlikely(ciphertext->size < tag_size))

    return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

  if (unlikely(params->read.iv_size != iv_size || iv_size < 8))

    return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

  memset(nonce, 0, iv_size - 8);

  _gnutls_write_uint64(sequence, &nonce[iv_size - 8]);

  memxor(nonce, params->read.iv, params->read.iv_size);

  length = ciphertext->size - tag_size;

  length_to_decrypt = ciphertext->size;

  if (unlikely((unsigned)length_to_decrypt > plain->size)) {

    _gnutls_audit_log(

      session,

      "Received %u bytes, while expecting less than %u\n",

      (unsigned int)length_to_decrypt,

      (unsigned int)plain->size);

    return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

  }

  aad[0] = GNUTLS_APPLICATION_DATA;

  aad[1] = 0x03;

  aad[2] = 0x03;

  _gnutls_write_uint16(ciphertext->size, &aad[3]);

  ret = gnutls_aead_cipher_decrypt(&params->read.ctx.aead, nonce, iv_size,

           aad, sizeof(aad), tag_size,

           ciphertext->data, length_to_decrypt,

           plain->data, &length);

  if (unlikely(ret < 0))

    return gnutls_assert_val(ret);

  /* 1 octet for content type */

  if (length > max_decrypted_size(session) + 1) {

    _gnutls_audit_log(session,

          "Received packet with illegal length: %u\n",

          (unsigned int)length);

    return gnutls_assert_val(GNUTLS_E_RECORD_OVERFLOW);

  }

  length_set = 0;

  /* now figure the actual data size. We intentionally iterate through all data,

   * to avoid leaking the padding length due to timing differences in processing.

   */

  for (j = length; j > 0; j--) {

    if (plain->data[j - 1] != 0 && length_set == 0) {

      *type = plain->data[j - 1];

      length = j - 1;

      length_set = 1;

      if (!(session->internals.flags &

            GNUTLS_SAFE_PADDING_CHECK))

        break;

    }

  }

  if (!length_set)

    return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

  return length;

}