Update to NSS 3.12.7.

net/third_party/nss/ssl/ssl3con.c

 /*
  * SSL3 Protocol
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
@@ skipping 21 matching lines @@
  * in which case the provisions of the GPL or the LGPL are applicable instead
  * of those above. If you wish to allow use of your version of this file only
  * under the terms of either the GPL or the LGPL, and not to allow others to
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
-/* $Id: ssl3con.c,v 1.134 2010/02/03 03:44:29 wtc%google.com Exp $ */
+/* $Id: ssl3con.c,v 1.142 2010/06/24 19:53:20 wtc%google.com Exp $ */
 
 #include "cert.h"
 #include "ssl.h"
 #include "cryptohi.h"   /* for DSAU_ stuff */
 #include "keyhi.h"
 #include "secder.h"
 #include "secitem.h"
 
 #include "sslimpl.h"
 #include "sslproto.h"
@@ skipping 510 matching lines @@
     PRInt32 high;
 #else
     PRInt32 high;
     PRInt32 low;
 #endif
 } tooLong;
 
 void SSL_AtomicIncrementLong(long * x)
 {
     if ((sizeof *x) == sizeof(PRInt32)) {
-        PR_AtomicIncrement((PRInt32 *)x);
+        PR_ATOMIC_INCREMENT((PRInt32 *)x);
     } else {
         tooLong * tl = (tooLong *)x;
-        if (PR_AtomicIncrement(&tl->low) == 0)
-            PR_AtomicIncrement(&tl->high);
+        if (PR_ATOMIC_INCREMENT(&tl->low) == 0)
+            PR_ATOMIC_INCREMENT(&tl->high);
     }
 }
 
 /* return pointer to ssl3CipherSuiteDef for suite, or NULL */
 /* XXX This does a linear search.  A binary search would be better. */
 const ssl3CipherSuiteDef *
 ssl_LookupCipherSuiteDef(ssl3CipherSuite suite)
 {
     int cipher_suite_def_len =
         sizeof(cipher_suite_defs) / sizeof(cipher_suite_defs[0]);
@@ skipping 2019 matching lines @@
     buf->len = 0;
     SSL_TRC(5, ("%d: SSL3[%d] received alert, level = %d, description = %d",
         SSL_GETPID(), ss->fd, level, desc));
 
     switch (desc) {
     case close_notify:          ss->recvdCloseNotify = 1;
                                 error = SSL_ERROR_CLOSE_NOTIFY_ALERT;     break;
     case unexpected_message:    error = SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT;
                                                                           break;
     case bad_record_mac:        error = SSL_ERROR_BAD_MAC_ALERT;          break;
-    case decryption_failed:     error = SSL_ERROR_DECRYPTION_FAILED_ALERT; 
+    case decryption_failed_RESERVED:
+                                error = SSL_ERROR_DECRYPTION_FAILED_ALERT; 
                                                                           break;
     case record_overflow:       error = SSL_ERROR_RECORD_OVERFLOW_ALERT;  break;
     case decompression_failure: error = SSL_ERROR_DECOMPRESSION_FAILURE_ALERT;
                                                                           break;
     case handshake_failure:     error = SSL_ERROR_HANDSHAKE_FAILURE_ALERT;
                                                                           break;
     case no_certificate:        error = SSL_ERROR_NO_CERTIFICATE;         break;
     case bad_certificate:       error = SSL_ERROR_BAD_CERT_ALERT;         break;
     case unsupported_certificate:error = SSL_ERROR_UNSUPPORTED_CERT_ALERT;break;
     case certificate_revoked:   error = SSL_ERROR_REVOKED_CERT_ALERT;     break;
@@ skipping 1319 matching lines @@
         return rv;      /* err set by ssl3_AppendHandshake* */
     }
 
     rv = ssl3_AppendHandshakeNumber(ss, num_suites*sizeof(ssl3CipherSuite), 2);
     if (rv != SECSuccess) {
         return rv;      /* err set by ssl3_AppendHandshake* */
     }
 
     if (ss->ssl3.hs.sendingSCSV) {
         /* Add the actual SCSV */
-        rv = ssl3_AppendHandshakeNumber(ss, TLS_RENEGO_PROTECTION_REQUEST,
+        rv = ssl3_AppendHandshakeNumber(ss, TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
                                         sizeof(ssl3CipherSuite));
         if (rv != SECSuccess) {
             return rv;  /* err set by ssl3_AppendHandshake* */
         }
         actual_count++;
     }
     for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) {
         ssl3CipherSuiteCfg *suite = &ss->cipherSuites[i];
         if (config_match(suite, ss->ssl3.policy, PR_TRUE)) {
             actual_count++;
@@ skipping 1336 matching lines @@
 
     case kt_dh: {
         SECItem          dh_p      = {siBuffer, NULL, 0};
         SECItem          dh_g      = {siBuffer, NULL, 0};
         SECItem          dh_Ys     = {siBuffer, NULL, 0};
 
         rv = ssl3_ConsumeHandshakeVariable(ss, &dh_p, 2, &b, &length);
         if (rv != SECSuccess) {
             goto loser;         /* malformed. */
         }
+        if (dh_p.len < 512/8)
+            goto alert_loser;
         rv = ssl3_ConsumeHandshakeVariable(ss, &dh_g, 2, &b, &length);
         if (rv != SECSuccess) {
             goto loser;         /* malformed. */
         }
+        if (dh_g.len == 0 || dh_g.len > dh_p.len + 1 ||
+           (dh_g.len == 1 && dh_g.data[0] == 0))
+            goto alert_loser;
         rv = ssl3_ConsumeHandshakeVariable(ss, &dh_Ys, 2, &b, &length);
         if (rv != SECSuccess) {
             goto loser;         /* malformed. */
         }
+        if (dh_Ys.len == 0 || dh_Ys.len > dh_p.len + 1 ||
+           (dh_Ys.len == 1 && dh_Ys.data[0] == 0))
+            goto alert_loser;
         rv = ssl3_ConsumeHandshakeVariable(ss, &signature, 2, &b, &length);
         if (rv != SECSuccess) {
             goto loser;         /* malformed. */
         }
         if (length != 0) {
             if (isTLS)
                 desc = decode_error;
             goto alert_loser;           /* malformed. */
         }
 
@@ skipping 666 matching lines @@
         return rv;              /* ssl3_InitState has set the error code. */
     }
 
     if ((ss->ssl3.hs.ws != wait_client_hello) &&
         (ss->ssl3.hs.ws != idle_handshake)) {
         desc    = unexpected_message;
         errCode = SSL_ERROR_RX_UNEXPECTED_CLIENT_HELLO;
         goto alert_loser;
     }
     if (ss->ssl3.hs.ws == idle_handshake  &&
-        (ss->opt.enableRenegotiation == SSL_RENEGOTIATE_NEVER ||
-         ss->opt.enableRenegotiation == SSL_RENEGOTIATE_CLIENT_ONLY)) {
+        ss->opt.enableRenegotiation == SSL_RENEGOTIATE_NEVER) {
         desc    = no_renegotiation;
         level   = alert_warning;
         errCode = SSL_ERROR_RENEGOTIATION_NOT_ALLOWED;
         goto alert_loser;
     }
 
     tmp = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length);
     if (tmp < 0)
         goto loser;             /* malformed, alert already sent */
     ss->clientHelloVersion = version = (SSL3ProtocolVersion)tmp;
@@ skipping 55 matching lines @@
             goto loser;         /* malformed */
         }
     }
     if (!ssl3_ExtensionNegotiated(ss, ssl_renegotiation_info_xtn)) {
         /* If we didn't receive an RI extension, look for the SCSV,
          * and if found, treat it just like an empty RI extension
          * by processing a local copy of an empty RI extension.
          */
         for (i = 0; i + 1 < suites.len; i += 2) {
             PRUint16 suite_i = (suites.data[i] << 8) | suites.data[i + 1];
-            if (suite_i == TLS_RENEGO_PROTECTION_REQUEST) {
+            if (suite_i == TLS_EMPTY_RENEGOTIATION_INFO_SCSV) {
                 SSL3Opaque * b2 = (SSL3Opaque *)emptyRIext;
                 PRUint32     L2 = sizeof emptyRIext;
                 (void)ssl3_HandleHelloExtensions(ss, &b2, &L2);
                 break;
             }
         }
     }
     if (ss->firstHsDone &&
-        ss->opt.enableRenegotiation == SSL_RENEGOTIATE_REQUIRES_XTN && 
+        (ss->opt.enableRenegotiation == SSL_RENEGOTIATE_REQUIRES_XTN ||
+        ss->opt.enableRenegotiation == SSL_RENEGOTIATE_TRANSITIONAL) && 
         !ssl3_ExtensionNegotiated(ss, ssl_renegotiation_info_xtn)) {
         desc    = no_renegotiation;
         level   = alert_warning;
         errCode = SSL_ERROR_RENEGOTIATION_NOT_ALLOWED;
         goto alert_loser;
     }
     if ((ss->opt.requireSafeNegotiation || 
          (ss->firstHsDone && ss->peerRequestedProtection)) &&
         !ssl3_ExtensionNegotiated(ss, ssl_renegotiation_info_xtn)) {
         desc = handshake_failure;
@@ skipping 685 matching lines @@
     errCode = SSL_ERROR_NO_CYPHER_OVERLAP;
     goto alert_loser;
 
 suite_found:
 
     /* Look for the SCSV, and if found, treat it just like an empty RI 
      * extension by processing a local copy of an empty RI extension.
      */
     for (i = 0; i+2 < suite_length; i += 3) {
         PRUint32 suite_i = (suites[i] << 16) | (suites[i+1] << 8) | suites[i+2];
-        if (suite_i == TLS_RENEGO_PROTECTION_REQUEST) {
+        if (suite_i == TLS_EMPTY_RENEGOTIATION_INFO_SCSV) {
             SSL3Opaque * b2 = (SSL3Opaque *)emptyRIext;
             PRUint32     L2 = sizeof emptyRIext;
             (void)ssl3_HandleHelloExtensions(ss, &b2, &L2);
             break;
         }
     }
 
     if (ss->opt.requireSafeNegotiation &&
         !ssl3_ExtensionNegotiated(ss, ssl_renegotiation_info_xtn)) {
         desc = handshake_failure;
@@ skipping 780 matching lines @@
     PRStatus    prStatus;
     PRFileInfo  info;
     char        cfn[100];
 
     pCertItem->data = 0;
     if ((testdir = PR_GetEnv("NISCC_TEST")) == NULL) {
         return SECSuccess;
     }
     *pIndex   = (NULL != strstr(testdir, "root"));
     extension = (strstr(testdir, "simple") ? "" : ".der");
-    fileNum     = PR_AtomicIncrement(&connNum) - 1;
+    fileNum     = PR_ATOMIC_INCREMENT(&connNum) - 1;
     if ((startat = PR_GetEnv("START_AT")) != NULL) {
         fileNum += atoi(startat);
     }
     if ((stopat = PR_GetEnv("STOP_AT")) != NULL && 
         fileNum >= atoi(stopat)) {
         *pIndex = -1;
         return SECSuccess;
     }
     sprintf(cfn, "%s/%08d%s", testdir, fileNum, extension);
     cf = PR_Open(cfn, PR_RDONLY, 0);
@@ skipping 1363 matching lines @@
         return SECFailure;
     }
 
     /* decrypt from cText buf to plaintext. */
     rv = crSpec->decode(
         crSpec->decodeContext, plaintext->buf, (int *)&plaintext->len,
         plaintext->space, cText->buf->buf, cText->buf->len);
 
     PRINT_BUF(80, (ss, "cleartext:", plaintext->buf, plaintext->len));
     if (rv != SECSuccess) {
-        int err = ssl_MapLowLevelError(SSL_ERROR_DECRYPTION_FAILURE);
-        ssl_ReleaseSpecReadLock(ss);
-        SSL3_SendAlert(ss, alert_fatal,
-                       isTLS ? decryption_failed : bad_record_mac);
-        PORT_SetError(err);
-        return SECFailure;
+        /* All decryption failures must be treated like a bad record
+         * MAC; see RFC 5246 (TLS 1.2). 
+         */
+        padIsBad = PR_TRUE;
     }
 
     /* If it's a block cipher, check and strip the padding. */
-    if (cipher_def->type == type_block) {
-        padding_length = *(plaintext->buf + plaintext->len - 1);
+    if (cipher_def->type == type_block && !padIsBad) {
+        PRUint8 * pPaddingLen = plaintext->buf + plaintext->len - 1;
+        padding_length = *pPaddingLen;
         /* TLS permits padding to exceed the block size, up to 255 bytes. */
         if (padding_length + 1 + crSpec->mac_size > plaintext->len)
             padIsBad = PR_TRUE;
-        /* if TLS, check value of first padding byte. */
-        else if (padding_length && isTLS && 
-                 padding_length != *(plaintext->buf +
-                                     plaintext->len - (padding_length + 1)))
-            padIsBad = PR_TRUE;
-        else
-            plaintext->len -= padding_length + 1;
+        else {
+            plaintext->len -= padding_length + 1;
+            /* In TLS all padding bytes must be equal to the padding length. */
+            if (isTLS) {
+                PRUint8 *p;
+                for (p = pPaddingLen - padding_length; p < pPaddingLen; ++p) {
+                    padIsBad |= *p ^ padding_length;
+                }
+            }
+        }
     }
 
     /* Remove the MAC. */
     if (plaintext->len >= crSpec->mac_size)
         plaintext->len -= crSpec->mac_size;
     else
         padIsBad = PR_TRUE;     /* really macIsBad */
 
     /* compute the MAC */
     rType = cText->type;
     rv = ssl3_ComputeRecordMAC( crSpec, (PRBool)(!ss->sec.isServer),
         rType, cText->version, crSpec->read_seq_num, 
         plaintext->buf, plaintext->len, hash, &hashBytes);
     if (rv != SECSuccess) {
-        int err = ssl_MapLowLevelError(SSL_ERROR_MAC_COMPUTATION_FAILURE);
-        ssl_ReleaseSpecReadLock(ss);
-        SSL3_SendAlert(ss, alert_fatal, bad_record_mac);
-        PORT_SetError(err);
-        return rv;
+        padIsBad = PR_TRUE;     /* really macIsBad */
     }
 
     /* Check the MAC */
     if (hashBytes != (unsigned)crSpec->mac_size || padIsBad || 
         NSS_SecureMemcmp(plaintext->buf + plaintext->len, hash,
                          crSpec->mac_size) != 0) {
         /* must not hold spec lock when calling SSL3_SendAlert. */
         ssl_ReleaseSpecReadLock(ss);
         SSL3_SendAlert(ss, alert_fatal, bad_record_mac);
         /* always log mac error, in case attacker can read server logs. */
@@ skipping 78 matching lines @@
     if (isTLS && databuf->len > (MAX_FRAGMENT_LENGTH + 1024)) {
         SSL3_SendAlert(ss, alert_fatal, record_overflow);
         PORT_SetError(SSL_ERROR_RX_RECORD_TOO_LONG);
         return SECFailure;
     }
 
     /* Application data records are processed by the caller of this
     ** function, not by this function.
     */
     if (rType == content_application_data) {
-        return SECSuccess;
+        if (ss->firstHsDone)
+            return SECSuccess;
+        (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);
+        PORT_SetError(SSL_ERROR_RX_UNEXPECTED_APPLICATION_DATA);
+        return SECFailure;
     }
 
     /* It's a record that must be handled by ssl itself, not the application.
     */
 process_it:
     /* XXX  Get the xmit lock here.  Odds are very high that we'll be xmiting
      * data ang getting the xmit lock here prevents deadlocks.
      */
     ssl_GetSSL3HandshakeLock(ss);
 
@@ skipping 138 matching lines @@
         return NULL;                    /* error code is set. */
     pair->refCount = 1;
     pair->privKey  = privKey;
     pair->pubKey   = pubKey;
     return pair;                        /* success */
 }
 
 ssl3KeyPair *
 ssl3_GetKeyPairRef(ssl3KeyPair * keyPair)
 {
-    PR_AtomicIncrement(&keyPair->refCount);
+    PR_ATOMIC_INCREMENT(&keyPair->refCount);
     return keyPair;
 }
 
 void
 ssl3_FreeKeyPair(ssl3KeyPair * keyPair)
 {
-    PRInt32 newCount =  PR_AtomicDecrement(&keyPair->refCount);
+    PRInt32 newCount =  PR_ATOMIC_DECREMENT(&keyPair->refCount);
     if (!newCount) {
         if (keyPair->privKey)
             SECKEY_DestroyPrivateKey(keyPair->privKey);
         if (keyPair->pubKey)
             SECKEY_DestroyPublicKey( keyPair->pubKey);
         PORT_Free(keyPair);
     }
 }
 
 
@@ skipping 195 matching lines @@
 
     PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
 
     if (!ss->firstHsDone ||
         ((ss->version >= SSL_LIBRARY_VERSION_3_0) &&
          ss->ssl3.initialized && 
          (ss->ssl3.hs.ws != idle_handshake))) {
         PORT_SetError(SSL_ERROR_HANDSHAKE_NOT_COMPLETED);
         return SECFailure;
     }
-    if (ss->opt.enableRenegotiation == SSL_RENEGOTIATE_NEVER ||
-       (ss->opt.enableRenegotiation == SSL_RENEGOTIATE_CLIENT_ONLY &&
-        ss->sec.isServer)) {
+    if (ss->opt.enableRenegotiation == SSL_RENEGOTIATE_NEVER) {
         PORT_SetError(SSL_ERROR_RENEGOTIATION_NOT_ALLOWED);
         return SECFailure;
     }
     if (sid && flushCache) {
         ss->sec.uncache(sid);   /* remove it from whichever cache it's in. */
         ssl_FreeSID(sid);       /* dec ref count and free if zero. */
         ss->sec.ci.sid = NULL;
     }
 
     ssl_GetXmitBufLock(ss);     /**************************************/
@@ skipping 52 matching lines @@
 
     ss->ssl3.initialized = PR_FALSE;
 
     if (ss->ssl3.nextProto.data) {
         PORT_Free(ss->ssl3.nextProto.data);
         ss->ssl3.nextProto.data = NULL;
     }
 }
 
 /* End of ssl3con.c */