/src/gnutls/lib/cipher.c

Source (jump to first uncovered line)
/*
 * Copyright (C) 2000-2013 Free Software Foundation, Inc.
 * Copyright (C) 2013 Nikos Mavrogiannopoulos
 * Copyright (C) 2017-2018 Red Hat, Inc.
 *
 * Author: Nikos Mavrogiannopoulos
 *
 * This file is part of GnuTLS.
 *
 * The GnuTLS is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>
 *
 */

/* Some high level functions to be used in the record encryption are
 * included here.
 */

#include "gnutls_int.h"
#include "errors.h"
#include "cipher.h"
#include "algorithms.h"
#include "hash_int.h"
#include "cipher_int.h"
#include "debug.h"
#include "num.h"
#include "datum.h"
#include "kx.h"
#include "record.h"
#include "constate.h"
#include "mbuffers.h"
#include <state.h>
#include <random.h>

#include <nettle/memxor.h>

static int encrypt_packet(gnutls_session_t session,
        uint8_t * cipher_data, int cipher_size,
        gnutls_datum_t * plain,
        size_t min_pad,
        content_type_t _type, record_parameters_st * params);

static int decrypt_packet(gnutls_session_t session,
        gnutls_datum_t * ciphertext,
        gnutls_datum_t * plain,
        content_type_t type,
        record_parameters_st * params, uint64_t sequence);

static int
decrypt_packet_tls13(gnutls_session_t session,
         gnutls_datum_t * ciphertext,
         gnutls_datum_t * plain,
         content_type_t * type, record_parameters_st * params,
         uint64_t sequence);

static int
encrypt_packet_tls13(gnutls_session_t session,
         uint8_t * cipher_data, size_t cipher_size,
         gnutls_datum_t * plain,
         size_t pad_size,
         uint8_t type, record_parameters_st * params);

/* returns ciphertext which contains the headers too. This also
 * calculates the size in the header field.
 *
 */
int
_gnutls_encrypt(gnutls_session_t session,
    const uint8_t * data, size_t data_size,
    size_t min_pad,
    mbuffer_st * bufel,
    content_type_t type, record_parameters_st * params)
{
  gnutls_datum_t plaintext;
  const version_entry_st *vers =
      (session->internals.hsk_flags & HSK_EARLY_DATA_IN_FLIGHT) &&
      !IS_SERVER(session) ?
      session->internals.resumed_security_parameters.pversion :
      get_version(session);
  int ret;

  plaintext.data = (uint8_t *) data;
  plaintext.size = data_size;

  if (vers && vers->tls13_sem) {
    /* it fills the header, as it is included in the authenticated
     * data of the AEAD cipher. */
    ret =
        encrypt_packet_tls13(session,
           _mbuffer_get_udata_ptr(bufel),
           _mbuffer_get_udata_size(bufel),
           &plaintext, min_pad, type, params);
    if (ret < 0)
      return gnutls_assert_val(ret);
  } else {
    ret =
        encrypt_packet(session,
           _mbuffer_get_udata_ptr(bufel),
           _mbuffer_get_udata_size
           (bufel), &plaintext, min_pad, type, params);
    if (ret < 0)
      return gnutls_assert_val(ret);

  }

  if (IS_DTLS(session))
    _gnutls_write_uint16(ret, ((uint8_t *)
             _mbuffer_get_uhead_ptr(bufel)) + 11);
  else
    _gnutls_write_uint16(ret, ((uint8_t *)
             _mbuffer_get_uhead_ptr(bufel)) + 3);

  _mbuffer_set_udata_size(bufel, ret);
  _mbuffer_set_uhead_size(bufel, 0);

  return _mbuffer_get_udata_size(bufel);
}

/* Decrypts the given data.
 * Returns the decrypted data length.
 *
 * The output is preallocated with the maximum allowed data size.
 */
int
_gnutls_decrypt(gnutls_session_t session,
    gnutls_datum_t * ciphertext,
    gnutls_datum_t * output,
    content_type_t * type,
    record_parameters_st * params, uint64_t sequence)
{
  int ret;
  const version_entry_st *vers = get_version(session);

  if (ciphertext->size == 0)
    return 0;

  if (vers && vers->tls13_sem)
    ret =
        decrypt_packet_tls13(session, ciphertext,
           output, type, params, sequence);
  else
    ret =
        decrypt_packet(session, ciphertext,
           output, *type, params, sequence);
  if (ret < 0)
    return gnutls_assert_val(ret);

  return ret;
}

inline static int
calc_enc_length_block(gnutls_session_t session,
          const version_entry_st * ver,
          int data_size,
          int hash_size, uint8_t * pad,
          unsigned auth_cipher, uint16_t blocksize, unsigned etm)
{
  /* pad is the LH pad the user wants us to add. Besides
   * this LH pad, we only add minimal padding
   */
  unsigned int pre_length = data_size + *pad;
  unsigned int length, new_pad;

  if (etm == 0)
    pre_length += hash_size;

  new_pad = (uint8_t) (blocksize - (pre_length % blocksize)) + *pad;

  if (new_pad > 255)
    new_pad -= blocksize;
  *pad = new_pad;

  length = data_size + hash_size + *pad;

  if (_gnutls_version_has_explicit_iv(ver))
    length += blocksize; /* for the IV */

  return length;
}

inline static int
calc_enc_length_stream(gnutls_session_t session, int data_size,
           int hash_size, unsigned auth_cipher,
           unsigned exp_iv_size)
{
  unsigned int length;

  length = data_size + hash_size;
  if (auth_cipher)
    length += exp_iv_size;

  return length;
}

/* generates the authentication data (data to be hashed only
 * and are not to be sent). Returns their size.
 */
int
_gnutls_make_preamble(uint64_t uint64_data, uint8_t type, unsigned int length,
          const version_entry_st * ver,
          uint8_t preamble[MAX_PREAMBLE_SIZE])
{
  uint8_t *p = preamble;
  uint16_t c_length;

  c_length = _gnutls_conv_uint16(length);

  _gnutls_write_uint64(uint64_data, p);
  p += 8;
  *p = type;
  p++;
#ifdef ENABLE_SSL3
  if (ver->id != GNUTLS_SSL3)
#endif
  {     /* TLS protocols */
    *p = ver->major;
    p++;
    *p = ver->minor;
    p++;
  }
  memcpy(p, &c_length, 2);
  p += 2;
  return p - preamble;
}

/* This is the actual encryption
 * Encrypts the given plaintext datum, and puts the result to cipher_data,
 * which has cipher_size size.
 * return the actual encrypted data length.
 */
static int
encrypt_packet(gnutls_session_t session,
         uint8_t * cipher_data, int cipher_size,
         gnutls_datum_t * plain,
         size_t min_pad,
         content_type_t type, record_parameters_st * params)
{
  uint8_t pad;
  int length, ret;
  uint8_t preamble[MAX_PREAMBLE_SIZE];
  int preamble_size;
  int tag_size = _gnutls_auth_cipher_tag_len(&params->write.ctx.tls12);
  int blocksize = _gnutls_cipher_get_block_size(params->cipher);
  unsigned algo_type = _gnutls_cipher_type(params->cipher);
  uint8_t *data_ptr, *full_cipher_ptr;
  const version_entry_st *ver = get_version(session);
  int explicit_iv = _gnutls_version_has_explicit_iv(ver);
  int auth_cipher = _gnutls_auth_cipher_is_aead(&params->write.ctx.tls12);
  uint8_t nonce[MAX_CIPHER_IV_SIZE];
  unsigned imp_iv_size = 0, exp_iv_size = 0;
  bool etm = 0;

  if (unlikely(ver == NULL))
    return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

  if (algo_type == CIPHER_BLOCK && params->etm != 0)
    etm = 1;

  _gnutls_hard_log("ENC[%p]: cipher: %s, MAC: %s, Epoch: %u\n",
       session, _gnutls_cipher_get_name(params->cipher),
       _gnutls_mac_get_name(params->mac),
       (unsigned int)params->epoch);

  /* Calculate the encrypted length (padding etc.)
   */
  if (algo_type == CIPHER_BLOCK) {
    /* Call gnutls_rnd() once. Get data used for the IV
     */
    ret = gnutls_rnd(GNUTLS_RND_NONCE, nonce, blocksize);
    if (ret < 0)
      return gnutls_assert_val(ret);

    pad = min_pad;

    length =
        calc_enc_length_block(session, ver, plain->size,
            tag_size, &pad, auth_cipher,
            blocksize, etm);
  } else {   /* AEAD + STREAM */
    imp_iv_size =
        _gnutls_cipher_get_implicit_iv_size(params->cipher);
    exp_iv_size =
        _gnutls_cipher_get_explicit_iv_size(params->cipher);

    pad = 0;
    length =
        calc_enc_length_stream(session, plain->size,
             tag_size, auth_cipher, exp_iv_size);
  }

  if (length < 0)
    return gnutls_assert_val(length);

  /* copy the encrypted data to cipher_data.
   */
  if (cipher_size < length)
    return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

  data_ptr = cipher_data;
  full_cipher_ptr = data_ptr;

  if (algo_type == CIPHER_BLOCK || algo_type == CIPHER_STREAM) {
    if (algo_type == CIPHER_BLOCK && explicit_iv != 0) {
      /* copy the random IV.
       */
      memcpy(data_ptr, nonce, blocksize);
      ret =
          _gnutls_auth_cipher_setiv(&params->write.ctx.tls12,
                  data_ptr, blocksize);
      if (ret < 0)
        return gnutls_assert_val(ret);

      /*data_ptr += blocksize; */
      cipher_data += blocksize;
    }
  } else {   /* AEAD */
    if ((params->cipher->flags & GNUTLS_CIPHER_FLAG_XOR_NONCE) == 0) {
      /* Values in AEAD are pretty fixed in TLS 1.2 for 128-bit block
       */
      if (params->write.iv_size != imp_iv_size)
        return
            gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

      /* Instead of generating a new nonce on every packet, we use the
       * write.sequence_number (It is a MAY on RFC 5288), and safer
       * as it will never reuse a value.
       */
      memcpy(nonce, params->write.iv, params->write.iv_size);
      _gnutls_write_uint64(params->write.sequence_number,
               &nonce[imp_iv_size]);

      memcpy(data_ptr, &nonce[imp_iv_size], exp_iv_size);

      /*data_ptr += exp_iv_size; */
      cipher_data += exp_iv_size;
    } else { /* XOR nonce with IV */
      if (unlikely
          (params->write.iv_size != 12 || imp_iv_size != 12
           || exp_iv_size != 0))
        return
            gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

      memset(nonce, 0, 4);
      _gnutls_write_uint64(params->write.sequence_number,
               &nonce[4]);

      memxor(nonce, params->write.iv, 12);
    }
  }

  if (etm)
    ret = length - tag_size;
  else
    ret = plain->size;

  preamble_size =
      _gnutls_make_preamble(params->write.sequence_number,
          type, ret, ver, preamble);

  if (algo_type == CIPHER_BLOCK || algo_type == CIPHER_STREAM) {
    /* add the authenticated data */
    ret =
        _gnutls_auth_cipher_add_auth(&params->write.ctx.tls12,
             preamble, preamble_size);
    if (ret < 0)
      return gnutls_assert_val(ret);

    if (etm && explicit_iv) {
      /* In EtM we need to hash the IV as well */
      ret =
          _gnutls_auth_cipher_add_auth(&params->write.
               ctx.tls12,
               full_cipher_ptr,
               blocksize);
      if (ret < 0)
        return gnutls_assert_val(ret);
    }

    /* Actual encryption.
     */
    ret =
        _gnutls_auth_cipher_encrypt2_tag(&params->write.ctx.tls12,
                 plain->data,
                 plain->size, cipher_data,
                 cipher_size, pad);
    if (ret < 0)
      return gnutls_assert_val(ret);
  } else {   /* AEAD */
    ret =
        _gnutls_aead_cipher_encrypt(&params->write.ctx.tls12.cipher,
            nonce,
            imp_iv_size + exp_iv_size,
            preamble, preamble_size,
            tag_size, plain->data,
            plain->size, cipher_data,
            cipher_size);
    if (ret < 0)
      return gnutls_assert_val(ret);
  }

  return length;
}

static int
encrypt_packet_tls13(gnutls_session_t session,
         uint8_t * cipher_data, size_t cipher_size,
         gnutls_datum_t * plain,
         size_t pad_size,
         uint8_t type, record_parameters_st * params)
{
  int ret;
  unsigned int tag_size = params->write.aead_tag_size;
  const version_entry_st *ver = get_version(session);
  uint8_t nonce[MAX_CIPHER_IV_SIZE];
  unsigned iv_size = 0;
  ssize_t max, total;
  uint8_t aad[5];
  giovec_t auth_iov[1];
  giovec_t iov[2];

  if (unlikely(ver == NULL))
    return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

  _gnutls_hard_log("ENC[%p]: cipher: %s, MAC: %s, Epoch: %u\n",
       session, _gnutls_cipher_get_name(params->cipher),
       _gnutls_mac_get_name(params->mac),
       (unsigned int)params->epoch);

  iv_size = params->write.iv_size;

  if (params->cipher->id == GNUTLS_CIPHER_NULL) {
    if (cipher_size < plain->size + 1)
      return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
    memcpy(cipher_data, plain->data, plain->size);
    return plain->size;
  }

  if (unlikely(iv_size < 8))
    return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

  memset(nonce, 0, iv_size - 8);
  _gnutls_write_uint64(params->write.sequence_number,
           &nonce[iv_size - 8]);
  memxor(nonce, params->write.iv, iv_size);

  max = max_record_send_size(session) + MAX_RECORD_SEND_OVERHEAD(session);

  /* make TLS 1.3 form of data */
  total = plain->size + 1 + pad_size;

  /* check whether padding would exceed max */
  if (total > max) {
    if (unlikely(max < (ssize_t) plain->size + 1))
      return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

    pad_size = max - plain->size - 1;
    total = max;
  }

  /* create authenticated data header */
  aad[0] = GNUTLS_APPLICATION_DATA;
  aad[1] = 0x03;
  aad[2] = 0x03;
  _gnutls_write_uint16(total + tag_size, &aad[3]);

  auth_iov[0].iov_base = aad;
  auth_iov[0].iov_len = sizeof(aad);

  iov[0].iov_base = plain->data;
  iov[0].iov_len = plain->size;

  if (pad_size || (session->internals.flags & GNUTLS_SAFE_PADDING_CHECK)) {
    uint8_t *pad = gnutls_calloc(1, 1 + pad_size);
    if (pad == NULL)
      return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);

    pad[0] = type;

    iov[1].iov_base = pad;
    iov[1].iov_len = 1 + pad_size;

    ret = gnutls_aead_cipher_encryptv(&params->write.ctx.aead,
              nonce, iv_size,
              auth_iov, 1,
              tag_size,
              iov, 2,
              cipher_data, &cipher_size);
    gnutls_free(pad);
  } else {
    iov[1].iov_base = &type;
    iov[1].iov_len = 1;

    ret = gnutls_aead_cipher_encryptv(&params->write.ctx.aead,
              nonce, iv_size,
              auth_iov, 1,
              tag_size,
              iov, 2,
              cipher_data, &cipher_size);
  }

  if (ret < 0)
    return gnutls_assert_val(ret);

  return cipher_size;
}

/* Deciphers the ciphertext packet, and puts the result to plain.
 * Returns the actual plaintext packet size.
 */
static int
decrypt_packet(gnutls_session_t session,
         gnutls_datum_t * ciphertext,
         gnutls_datum_t * plain,
         content_type_t type, record_parameters_st * params,
         uint64_t sequence)
{
  uint8_t tag[MAX_HASH_SIZE];
  uint8_t nonce[MAX_CIPHER_IV_SIZE];
  const uint8_t *tag_ptr = NULL;
  unsigned int pad = 0;
  int length, length_to_decrypt;
  uint16_t blocksize;
  int ret;
  uint8_t preamble[MAX_PREAMBLE_SIZE];
  unsigned int preamble_size = 0;
  const version_entry_st *ver = get_version(session);
  unsigned int tag_size =
      _gnutls_auth_cipher_tag_len(&params->read.ctx.tls12);
  unsigned int explicit_iv = _gnutls_version_has_explicit_iv(ver);
  unsigned imp_iv_size, exp_iv_size;
  unsigned cipher_type = _gnutls_cipher_type(params->cipher);
  bool etm = 0;

  if (unlikely(ver == NULL))
    return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

  imp_iv_size = _gnutls_cipher_get_implicit_iv_size(params->cipher);
  exp_iv_size = _gnutls_cipher_get_explicit_iv_size(params->cipher);
  blocksize = _gnutls_cipher_get_block_size(params->cipher);

  if (params->etm != 0 && cipher_type == CIPHER_BLOCK)
    etm = 1;

  /* if EtM mode and not AEAD */
  if (etm) {
    if (unlikely(ciphertext->size < tag_size))
      return
          gnutls_assert_val
          (GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

    preamble_size = _gnutls_make_preamble(sequence,
                  type,
                  ciphertext->size -
                  tag_size, ver, preamble);

    ret =
        _gnutls_auth_cipher_add_auth(&params->read.ctx.tls12,
             preamble, preamble_size);
    if (unlikely(ret < 0))
      return gnutls_assert_val(ret);

    ret = _gnutls_auth_cipher_add_auth(&params->read.ctx.tls12,
               ciphertext->data,
               ciphertext->size - tag_size);
    if (unlikely(ret < 0))
      return gnutls_assert_val(ret);

    ret =
        _gnutls_auth_cipher_tag(&params->read.ctx.tls12, tag,
              tag_size);
    if (unlikely(ret < 0))
      return gnutls_assert_val(ret);

    if (unlikely
        (gnutls_memcmp
         (tag, &ciphertext->data[ciphertext->size - tag_size],
          tag_size) != 0)) {
      /* HMAC was not the same. */
      return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);
    }
  }

  /* actual decryption (inplace)
   */
  switch (cipher_type) {
  case CIPHER_AEAD:
    /* The way AEAD ciphers are defined in RFC5246, it allows
     * only stream ciphers.
     */
    if (unlikely
        (_gnutls_auth_cipher_is_aead(&params->read.ctx.tls12) == 0))
      return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

    if (unlikely(ciphertext->size < (tag_size + exp_iv_size)))
      return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

    if ((params->cipher->flags & GNUTLS_CIPHER_FLAG_XOR_NONCE) == 0) {
      /* Values in AEAD are pretty fixed in TLS 1.2 for 128-bit block
       */
      if (unlikely(params->read.iv_size != 4))
        return
            gnutls_assert_val
            (GNUTLS_E_DECRYPTION_FAILED);

      memcpy(nonce, params->read.iv, imp_iv_size);

      memcpy(&nonce[imp_iv_size],
             ciphertext->data, exp_iv_size);

      ciphertext->data += exp_iv_size;
      ciphertext->size -= exp_iv_size;
    } else { /* XOR nonce with IV */
      if (unlikely
          (params->read.iv_size != 12 || imp_iv_size != 12
           || exp_iv_size != 0))
        return
            gnutls_assert_val
            (GNUTLS_E_DECRYPTION_FAILED);

      memset(nonce, 0, 4);
      _gnutls_write_uint64(sequence, &nonce[4]);

      memxor(nonce, params->read.iv, 12);
    }

    length = ciphertext->size - tag_size;

    length_to_decrypt = ciphertext->size;

    /* Pass the type, version, length and plain through
     * MAC.
     */
    preamble_size =
        _gnutls_make_preamble(sequence, type,
            length, ver, preamble);

    if (unlikely((unsigned)length_to_decrypt > plain->size)) {
      _gnutls_audit_log(session,
            "Received %u bytes, while expecting less than %u\n",
            (unsigned int)length_to_decrypt,
            (unsigned int)plain->size);
      return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);
    }

    ret =
        _gnutls_aead_cipher_decrypt(&params->read.ctx.tls12.cipher,
            nonce,
            exp_iv_size + imp_iv_size,
            preamble, preamble_size,
            tag_size, ciphertext->data,
            length_to_decrypt, plain->data,
            plain->size);
    if (unlikely(ret < 0))
      return gnutls_assert_val(ret);

    return length;

    break;
  case CIPHER_STREAM:
    if (unlikely(ciphertext->size < tag_size))
      return
          gnutls_assert_val
          (GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

    length_to_decrypt = ciphertext->size;
    length = ciphertext->size - tag_size;
    tag_ptr = plain->data + length;

    /* Pass the type, version, length and plain through
     * MAC.
     */
    preamble_size =
        _gnutls_make_preamble(sequence, type,
            length, ver, preamble);

    ret =
        _gnutls_auth_cipher_add_auth(&params->read.ctx.tls12,
             preamble, preamble_size);
    if (unlikely(ret < 0))
      return gnutls_assert_val(ret);

    if (unlikely((unsigned)length_to_decrypt > plain->size)) {
      _gnutls_audit_log(session,
            "Received %u bytes, while expecting less than %u\n",
            (unsigned int)length_to_decrypt,
            (unsigned int)plain->size);
      return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);
    }

    ret =
        _gnutls_auth_cipher_decrypt2(&params->read.ctx.tls12,
             ciphertext->data,
             length_to_decrypt,
             plain->data, plain->size);

    if (unlikely(ret < 0))
      return gnutls_assert_val(ret);

    ret =
        _gnutls_auth_cipher_tag(&params->read.ctx.tls12, tag,
              tag_size);
    if (unlikely(ret < 0))
      return gnutls_assert_val(ret);

    if (unlikely(gnutls_memcmp(tag, tag_ptr, tag_size) != 0)) {
      return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);
    }

    break;
  case CIPHER_BLOCK:
    if (unlikely(ciphertext->size < blocksize))
      return
          gnutls_assert_val
          (GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

    if (etm == 0) {
      if (unlikely(ciphertext->size % blocksize != 0))
        return
            gnutls_assert_val
            (GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
    } else {
      if (unlikely
          ((ciphertext->size - tag_size) % blocksize != 0))
        return
            gnutls_assert_val
            (GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
    }

    /* ignore the IV in TLS 1.1+
     */
    if (explicit_iv) {
      ret = _gnutls_auth_cipher_setiv(&params->read.ctx.tls12,
              ciphertext->data,
              blocksize);
      if (ret < 0)
        return gnutls_assert_val(ret);

      memcpy(nonce, ciphertext->data, blocksize);
      ciphertext->size -= blocksize;
      ciphertext->data += blocksize;
    }

    if (unlikely(ciphertext->size < tag_size + 1))
      return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

    /* we don't use the auth_cipher interface here, since
     * TLS with block ciphers is impossible to be used under such
     * an API. (the length of plaintext is required to calculate
     * auth_data, but it is not available before decryption).
     */
    if (unlikely(ciphertext->size > plain->size))
      return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

    if (etm == 0) {
      ret =
          _gnutls_cipher_decrypt2(&params->read.ctx.tls12.
                cipher, ciphertext->data,
                ciphertext->size,
                plain->data, plain->size);
      if (unlikely(ret < 0))
        return gnutls_assert_val(ret);

      ret = cbc_mac_verify(session, params, preamble, type,
               sequence, plain->data,
               ciphertext->size, tag_size);
      if (unlikely(ret < 0))
        return gnutls_assert_val(ret);

      length = ret;
    } else { /* EtM */
      ret =
          _gnutls_cipher_decrypt2(&params->read.ctx.tls12.
                cipher, ciphertext->data,
                ciphertext->size - tag_size,
                plain->data, plain->size);
      if (unlikely(ret < 0))
        return gnutls_assert_val(ret);

      pad = plain->data[ciphertext->size - tag_size - 1]; /* pad */
      length = ciphertext->size - tag_size - pad - 1;

      if (unlikely(length < 0))
        return
            gnutls_assert_val
            (GNUTLS_E_DECRYPTION_FAILED);
    }
    break;
  default:
    return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);
  }

  return length;
}

static int
decrypt_packet_tls13(gnutls_session_t session,
         gnutls_datum_t * ciphertext,
         gnutls_datum_t * plain,
         content_type_t * type, record_parameters_st * params,
         uint64_t sequence)
{
  uint8_t nonce[MAX_CIPHER_IV_SIZE];
  size_t length, length_to_decrypt;
  int ret;
  const version_entry_st *ver = get_version(session);
  unsigned int tag_size = params->read.aead_tag_size;
  unsigned iv_size;
  unsigned j;
  volatile unsigned length_set;
  uint8_t aad[5];

  if (unlikely(ver == NULL))
    return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

  if (params->cipher->id == GNUTLS_CIPHER_NULL) {
    if (plain->size < ciphertext->size)
      return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

    length = ciphertext->size;
    memcpy(plain->data, ciphertext->data, length);

    return length;
  }

  iv_size = _gnutls_cipher_get_iv_size(params->cipher);

  /* The way AEAD ciphers are defined in RFC5246, it allows
   * only stream ciphers.
   */
  if (unlikely(ciphertext->size < tag_size))
    return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

  if (unlikely(params->read.iv_size != iv_size || iv_size < 8))
    return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

  memset(nonce, 0, iv_size - 8);
  _gnutls_write_uint64(sequence, &nonce[iv_size - 8]);
  memxor(nonce, params->read.iv, params->read.iv_size);

  length = ciphertext->size - tag_size;

  length_to_decrypt = ciphertext->size;

  if (unlikely((unsigned)length_to_decrypt > plain->size)) {
    _gnutls_audit_log(session,
          "Received %u bytes, while expecting less than %u\n",
          (unsigned int)length_to_decrypt,
          (unsigned int)plain->size);
    return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);
  }

  aad[0] = GNUTLS_APPLICATION_DATA;
  aad[1] = 0x03;
  aad[2] = 0x03;
  _gnutls_write_uint16(ciphertext->size, &aad[3]);

  ret = gnutls_aead_cipher_decrypt(&params->read.ctx.aead,
           nonce, iv_size,
           aad, sizeof(aad),
           tag_size,
           ciphertext->data, length_to_decrypt,
           plain->data, &length);
  if (unlikely(ret < 0))
    return gnutls_assert_val(ret);

  /* 1 octet for content type */
  if (length > max_decrypted_size(session) + 1) {
    _gnutls_audit_log
        (session, "Received packet with illegal length: %u\n",
         (unsigned int)length);

    return gnutls_assert_val(GNUTLS_E_RECORD_OVERFLOW);
  }

  length_set = 0;

  /* now figure the actual data size. We intentionally iterate through all data,
   * to avoid leaking the padding length due to timing differences in processing.
   */
  for (j = length; j > 0; j--) {
    if (plain->data[j - 1] != 0 && length_set == 0) {
      *type = plain->data[j - 1];
      length = j - 1;
      length_set = 1;
      if (!
          (session->
           internals.flags & GNUTLS_SAFE_PADDING_CHECK))
        break;
    }
  }

  if (!length_set)
    return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

  return length;
}

Coverage Report

Created: 2023-03-26 08:33