Update NSS to NSS 3.13.4 pre-release snapshot 20120319.

net/third_party/nss/ssl/ssl3con.c

+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
 /*
  * SSL3 Protocol
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
@@ skipping 21 matching lines @@
  * in which case the provisions of the GPL or the LGPL are applicable instead
  * of those above. If you wish to allow use of your version of this file only
  * under the terms of either the GPL or the LGPL, and not to allow others to
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
-/* $Id: ssl3con.c,v 1.164 2012/02/17 09:50:04 kaie%kuix.de Exp $ */
+/* $Id: ssl3con.c,v 1.173 2012/03/18 00:31:19 wtc%google.com Exp $ */
 
 #include "cert.h"
 #include "ssl.h"
 #include "cryptohi.h"   /* for DSAU_ stuff */
 #include "keyhi.h"
 #include "secder.h"
 #include "secitem.h"
 
 #include "sslimpl.h"
 #include "sslproto.h"
@@ skipping 82 matching lines @@
  { TLS_DHE_RSA_WITH_AES_128_CBC_SHA,       SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
  { TLS_DHE_DSS_WITH_AES_128_CBC_SHA,       SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 #ifdef NSS_ENABLE_ECC
  { TLS_ECDH_RSA_WITH_RC4_128_SHA,          SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
  { TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,      SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
  { TLS_ECDH_ECDSA_WITH_RC4_128_SHA,        SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
  { TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,    SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 #endif /* NSS_ENABLE_ECC */
  { TLS_RSA_WITH_SEED_CBC_SHA,              SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, 
  { TLS_RSA_WITH_CAMELLIA_128_CBC_SHA,      SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
+ { SSL_RSA_WITH_RC4_128_SHA,               SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
  { SSL_RSA_WITH_RC4_128_MD5,               SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE},
- { SSL_RSA_WITH_RC4_128_SHA,               SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
  { TLS_RSA_WITH_AES_128_CBC_SHA,           SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 
 #ifdef NSS_ENABLE_ECC
  { TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,  SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
  { TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,    SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 #endif /* NSS_ENABLE_ECC */
  { SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,      SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
  { SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,      SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 #ifdef NSS_ENABLE_ECC
  { TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,     SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
@@ skipping 474 matching lines @@
     int                       numPresent                = 0;
     int                       numEnabled                = 0;
     PRBool                    isServer;
     sslServerCerts           *svrAuth;
 
     PORT_Assert(ss);
     if (!ss) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return 0;
     }
-    if (!ss->opt.enableSSL3 && !ss->opt.enableTLS) {
+    if (SSL3_ALL_VERSIONS_DISABLED(&ss->vrange)) {
         return 0;
     }
     isServer = (PRBool)(ss->sec.isServer != 0);
 
     for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) {
         suite = &ss->cipherSuites[i];
         if (suite->enabled) {
             ++numEnabled;
             /* We need the cipher defs to see if we have a token that can handle
              * this cipher.  It isn't part of the static definition.
@@ skipping 83 matching lines @@
                     suite->policy <= policy);
 }
 
 /* return number of cipher suites that match policy and enabled state */
 /* called from ssl3_SendClientHello and ssl3_ConstructV2CipherSpecsHack */
 static int
 count_cipher_suites(sslSocket *ss, int policy, PRBool enabled)
 {
     int i, count = 0;
 
-    if (!ss->opt.enableSSL3 && !ss->opt.enableTLS) {
+    if (SSL3_ALL_VERSIONS_DISABLED(&ss->vrange)) {
         return 0;
     }
     for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) {
         if (config_match(&ss->cipherSuites[i], policy, enabled))
             count++;
     }
     if (count <= 0) {
         PORT_SetError(SSL_ERROR_SSL_DISABLED);
     }
     return count;
 }
 
-static PRBool
-anyRestrictedEnabled(sslSocket *ss)
-{
-    int i;
-
-    if (!ss->opt.enableSSL3 && !ss->opt.enableTLS) {
-        return PR_FALSE;
-    }
-    for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) {
-        ssl3CipherSuiteCfg *suite = &ss->cipherSuites[i];
-        if (suite->policy == SSL_RESTRICTED &&
-            suite->enabled &&
-            suite->isPresent)
-            return PR_TRUE;
-    }
-    return PR_FALSE;
-}
-
 /*
  * Null compression, mac and encryption functions
  */
 
 static SECStatus
 Null_Cipher(void *ctx, unsigned char *output, int *outputLen, int maxOutputLen,
             const unsigned char *input, int inputLen)
 {
     *outputLen = inputLen;
     if (input != output)
         PORT_Memcpy(output, input, inputLen);
     return SECSuccess;
 }
 
 /*
  * SSL3 Utility functions
  */
 
+/* allowLargerPeerVersion controls whether the function will select the
+ * highest enabled SSL version or fail when peerVersion is greater than the
+ * highest enabled version.
+ *
+ * If allowLargerPeerVersion is true, peerVersion is the peer's highest
+ * enabled version rather than the peer's selected version.
+ */
 SECStatus
-ssl3_NegotiateVersion(sslSocket *ss, SSL3ProtocolVersion peerVersion)
+ssl3_NegotiateVersion(sslSocket *ss, SSL3ProtocolVersion peerVersion,
+                      PRBool allowLargerPeerVersion)
 {
-    SSL3ProtocolVersion version;
-    SSL3ProtocolVersion maxVersion;
-
-    if (ss->opt.enableTLS) {
-        maxVersion = SSL_LIBRARY_VERSION_3_1_TLS;
-    } else if (ss->opt.enableSSL3) {
-        maxVersion = SSL_LIBRARY_VERSION_3_0;
-    } else {
-        /* what are we doing here? */
-        PORT_Assert(ss->opt.enableSSL3 || ss->opt.enableTLS);
+    if (SSL3_ALL_VERSIONS_DISABLED(&ss->vrange)) {
         PORT_SetError(SSL_ERROR_SSL_DISABLED);
         return SECFailure;
     }
 
-    ss->version = version = PR_MIN(maxVersion, peerVersion);
-
-    if ((version == SSL_LIBRARY_VERSION_3_1_TLS && ss->opt.enableTLS) ||
-        (version == SSL_LIBRARY_VERSION_3_0     && ss->opt.enableSSL3)) {
-        return SECSuccess;
+    if (peerVersion < ss->vrange.min ||
+        (peerVersion > ss->vrange.max && !allowLargerPeerVersion)) {
+        PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP);
+        return SECFailure;
     }
 
-    PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP);
-    return SECFailure;
+    ss->version = PR_MIN(peerVersion, ss->vrange.max);
+    PORT_Assert(ssl3_VersionIsSupported(ssl_variant_stream, ss->version));
 
+    return SECSuccess;
 }
 
 static SECStatus
 ssl3_GetNewRandom(SSL3Random *random)
 {
     PRUint32 gmt = ssl_Time();
     SECStatus rv;
 
     random->rand[0] = (unsigned char)(gmt >> 24);
     random->rand[1] = (unsigned char)(gmt >> 16);
@@ skipping 595 matching lines @@
 }
 
 /* Initialize encryption and MAC contexts for pending spec.
  * Master Secret already is derived in spec->msItem
  * Caller holds Spec write lock.
  */
 static SECStatus
 ssl3_InitPendingContextsBypass(sslSocket *ss)
 {
       ssl3CipherSpec  *  pwSpec;
-const ssl3BulkCipherDef *cipher_def;
+      const ssl3BulkCipherDef *cipher_def;
       void *             serverContext = NULL;
       void *             clientContext = NULL;
       BLapiInitContextFunc initFn = (BLapiInitContextFunc)NULL;
       int                mode     = 0;
       unsigned int       optArg1  = 0;
       unsigned int       optArg2  = 0;
       PRBool             server_encrypts = ss->sec.isServer;
       CK_ULONG           macLength;
       SSLCipherAlgorithm calg;
       SSLCompressionMethod compression_method;
@@ skipping 168 matching lines @@
 }
 
 /* Initialize encryption and MAC contexts for pending spec.
  * Master Secret already is derived.
  * Caller holds Spec write lock.
  */
 static SECStatus
 ssl3_InitPendingContextsPKCS11(sslSocket *ss)
 {
       ssl3CipherSpec  *  pwSpec;
-const ssl3BulkCipherDef *cipher_def;
+      const ssl3BulkCipherDef *cipher_def;
       PK11Context *      serverContext = NULL;
       PK11Context *      clientContext = NULL;
       SECItem *          param;
       CK_MECHANISM_TYPE  mechanism;
       CK_MECHANISM_TYPE  mac_mech;
       CK_ULONG           macLength;
       CK_ULONG           effKeyBits;
       SECItem            iv;
       SECItem            mac_param;
       SSLCipherAlgorithm calg;
@@ skipping 407 matching lines @@
 static SECStatus
 ssl3_CompressMACEncryptRecord(ssl3CipherSpec *   cwSpec,
                               PRBool             isServer,
                               SSL3ContentType    type,
                               const SSL3Opaque * pIn,
                               PRUint32           contentLen,
                               sslBuffer *        wrBuf)
 {
     const ssl3BulkCipherDef * cipher_def;
     SECStatus                 rv;
-    PRUint32                  macLen      = 0;
+    PRUint32                  macLen = 0;
     PRUint32                  fragLen;
     PRUint32  p1Len, p2Len, oddLen = 0;
-    PRInt32   cipherBytes =  0;
+    int                       ivLen = 0;
+    int                       cipherBytes = 0;
 
     cipher_def = cwSpec->cipher_def;
 
+    if (cipher_def->type == type_block &&
+        cwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_1) {
+        /* Prepend the per-record explicit IV using technique 2b from
+         * RFC 4346 section 6.2.3.2: The IV is a cryptographically
+         * strong random number XORed with the CBC residue from the previous
+         * record.
+         */
+        ivLen = cipher_def->iv_size;
+        if (ivLen > wrBuf->space - SSL3_RECORD_HEADER_LENGTH) {
+            PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
+            return SECFailure;
+        }
+        rv = PK11_GenerateRandom(wrBuf->buf + SSL3_RECORD_HEADER_LENGTH, ivLen);
+        if (rv != SECSuccess) {
+            ssl_MapLowLevelError(SSL_ERROR_GENERATE_RANDOM_FAILURE);
+            return rv;
+        }
+        rv = cwSpec->encode( cwSpec->encodeContext, 
+            wrBuf->buf + SSL3_RECORD_HEADER_LENGTH,
+            &cipherBytes,                       /* output and actual outLen */
+            ivLen,                              /* max outlen */
+            wrBuf->buf + SSL3_RECORD_HEADER_LENGTH,
+            ivLen);                             /* input and inputLen*/
+        if (rv != SECSuccess || cipherBytes != ivLen) {
+            PORT_SetError(SSL_ERROR_ENCRYPTION_FAILURE);
+            return SECFailure;
+        }
+    }
+
     if (cwSpec->compressor) {
         int outlen;
         rv = cwSpec->compressor(
-            cwSpec->compressContext, wrBuf->buf + SSL3_RECORD_HEADER_LENGTH,
-            &outlen, wrBuf->space - SSL3_RECORD_HEADER_LENGTH, pIn, contentLen);
+            cwSpec->compressContext,
+            wrBuf->buf + SSL3_RECORD_HEADER_LENGTH + ivLen, &outlen,
+            wrBuf->space - SSL3_RECORD_HEADER_LENGTH - ivLen, pIn, contentLen);
         if (rv != SECSuccess)
             return rv;
-        pIn = wrBuf->buf + SSL3_RECORD_HEADER_LENGTH;
+        pIn = wrBuf->buf + SSL3_RECORD_HEADER_LENGTH + ivLen;
         contentLen = outlen;
     }
 
     /*
      * Add the MAC
      */
     rv = ssl3_ComputeRecordMAC( cwSpec, isServer,
         type, cwSpec->version, cwSpec->write_seq_num, pIn, contentLen,
-        wrBuf->buf + contentLen + SSL3_RECORD_HEADER_LENGTH, &macLen);
+        wrBuf->buf + SSL3_RECORD_HEADER_LENGTH + ivLen + contentLen, &macLen);
     if (rv != SECSuccess) {
         ssl_MapLowLevelError(SSL_ERROR_MAC_COMPUTATION_FAILURE);
         return SECFailure;
     }
     p1Len   = contentLen;
     p2Len   = macLen;
     fragLen = contentLen + macLen;      /* needs to be encrypted */
     PORT_Assert(fragLen <= MAX_FRAGMENT_LENGTH + 1024);
 
     /*
      * Pad the text (if we're doing a block cipher)
      * then Encrypt it
      */
     if (cipher_def->type == type_block) {
         unsigned char * pBuf;
         int             padding_length;
         int             i;
 
         oddLen = contentLen % cipher_def->block_size;
         /* Assume blockSize is a power of two */
         padding_length = cipher_def->block_size - 1 -
                         ((fragLen) & (cipher_def->block_size - 1));
         fragLen += padding_length + 1;
         PORT_Assert((fragLen % cipher_def->block_size) == 0);
 
         /* Pad according to TLS rules (also acceptable to SSL3). */
-        pBuf = &wrBuf->buf[fragLen + SSL3_RECORD_HEADER_LENGTH - 1];
+        pBuf = &wrBuf->buf[SSL3_RECORD_HEADER_LENGTH + ivLen + fragLen - 1];
         for (i = padding_length + 1; i > 0; --i) {
             *pBuf-- = padding_length;
         }
         /* now, if contentLen is not a multiple of block size, fix it */
         p2Len = fragLen - p1Len;
     }
     if (p1Len < 256) {
         oddLen = p1Len;
         p1Len = 0;
     } else {
         p1Len -= oddLen;
     }
     if (oddLen) {
         p2Len += oddLen;
         PORT_Assert( (cipher_def->block_size < 2) || \
                      (p2Len % cipher_def->block_size) == 0);
-        memmove(wrBuf->buf + SSL3_RECORD_HEADER_LENGTH + p1Len,
+        memmove(wrBuf->buf + SSL3_RECORD_HEADER_LENGTH + ivLen + p1Len,
                 pIn + p1Len, oddLen);
     }
     if (p1Len > 0) {
+        int cipherBytesPart1 = -1;
         rv = cwSpec->encode( cwSpec->encodeContext, 
-            wrBuf->buf + SSL3_RECORD_HEADER_LENGTH, /* output */
-            &cipherBytes,                           /* actual outlen */
+            wrBuf->buf + SSL3_RECORD_HEADER_LENGTH + ivLen, /* output */
+            &cipherBytesPart1,                      /* actual outlen */
             p1Len,                                  /* max outlen */
             pIn, p1Len);                      /* input, and inputlen */
-        PORT_Assert(rv == SECSuccess && cipherBytes == p1Len);
-        if (rv != SECSuccess || cipherBytes != p1Len) {
+        PORT_Assert(rv == SECSuccess && cipherBytesPart1 == (int) p1Len);
+        if (rv != SECSuccess || cipherBytesPart1 != (int) p1Len) {
             PORT_SetError(SSL_ERROR_ENCRYPTION_FAILURE);
             return SECFailure;
         }
+        cipherBytes += cipherBytesPart1;
     }
     if (p2Len > 0) {
-        PRInt32 cipherBytesPart2 = -1;
+        int cipherBytesPart2 = -1;
         rv = cwSpec->encode( cwSpec->encodeContext, 
-            wrBuf->buf + SSL3_RECORD_HEADER_LENGTH + p1Len,
+            wrBuf->buf + SSL3_RECORD_HEADER_LENGTH + ivLen + p1Len,
             &cipherBytesPart2,          /* output and actual outLen */
             p2Len,                             /* max outlen */
-            wrBuf->buf + SSL3_RECORD_HEADER_LENGTH + p1Len,
+            wrBuf->buf + SSL3_RECORD_HEADER_LENGTH + ivLen + p1Len,
             p2Len);                            /* input and inputLen*/
-        PORT_Assert(rv == SECSuccess && cipherBytesPart2 == p2Len);
-        if (rv != SECSuccess || cipherBytesPart2 != p2Len) {
+        PORT_Assert(rv == SECSuccess && cipherBytesPart2 == (int) p2Len);
+        if (rv != SECSuccess || cipherBytesPart2 != (int) p2Len) {
             PORT_SetError(SSL_ERROR_ENCRYPTION_FAILURE);
             return SECFailure;
         }
         cipherBytes += cipherBytesPart2;
     }   
     PORT_Assert(cipherBytes <= MAX_FRAGMENT_LENGTH + 1024);
 
     ssl3_BumpSequenceNumber(&cwSpec->write_seq_num);
 
     wrBuf->len    = cipherBytes + SSL3_RECORD_HEADER_LENGTH;
@@ skipping 63 matching lines @@
     }
 
     while (nIn > 0) {
         PRUint32  contentLen = PR_MIN(nIn, MAX_FRAGMENT_LENGTH);
         unsigned int spaceNeeded;
         unsigned int numRecords;
 
         ssl_GetSpecReadLock(ss);    /********************************/
 
         if (nIn > 1 && ss->opt.cbcRandomIV &&
-            ss->ssl3.cwSpec->version <= SSL_LIBRARY_VERSION_3_1_TLS &&
+            ss->ssl3.cwSpec->version < SSL_LIBRARY_VERSION_TLS_1_1 &&
             type == content_application_data &&
             ss->ssl3.cwSpec->cipher_def->type == type_block /* CBC mode */) {
             /* We will split the first byte of the record into its own record,
              * as explained in the documentation for SSL_CBC_RANDOM_IV in ssl.h
              */
             numRecords = 2;
         } else {
             numRecords = 1;
         }
 
         spaceNeeded = contentLen + (numRecords * SSL3_BUFFER_FUDGE);
+        if (ss->ssl3.cwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_1 &&
+            ss->ssl3.cwSpec->cipher_def->type == type_block) {
+            spaceNeeded += ss->ssl3.cwSpec->cipher_def->iv_size;
+        }
         if (spaceNeeded > wrBuf->space) {
             rv = sslBuffer_Grow(wrBuf, spaceNeeded);
             if (rv != SECSuccess) {
                 SSL_DBG(("%d: SSL3[%d]: SendRecord, tried to get %d bytes",
                          SSL_GETPID(), ss->fd, spaceNeeded));
                 goto spec_locked_loser; /* sslBuffer_Grow set error code. */
             }
         }
 
         if (numRecords == 2) {
@@ skipping 1633 matching lines @@
             }
         }
         /* If we previously did client-auth, make sure that the token that
         ** holds the private key still exists, is logged in, hasn't been
         ** removed, etc.
         */
         if (sidOK && !ssl3_ClientAuthTokenPresent(sid)) {
             sidOK = PR_FALSE;
         }
 
+        if (sidOK && ssl3_NegotiateVersion(ss, sid->version,
+                                           PR_FALSE) != SECSuccess) {
+            sidOK = PR_FALSE;
+        }
+
         if (!sidOK) {
             SSL_AtomicIncrementLong(& ssl3stats.sch_sid_cache_not_ok );
             (*ss->sec.uncache)(sid);
             ssl_FreeSID(sid);
             sid = NULL;
         }
     }
 
     if (sid) {
         SSL_AtomicIncrementLong(& ssl3stats.sch_sid_cache_hits );
 
         /* Are we attempting a stateless session resume? */
         if (sid->version > SSL_LIBRARY_VERSION_3_0 &&
             sid->u.ssl3.sessionTicket.ticket.data)
             SSL_AtomicIncrementLong(& ssl3stats.sch_sid_stateless_resumes );
 
-        rv = ssl3_NegotiateVersion(ss, sid->version);
-        if (rv != SECSuccess)
-            return rv;  /* error code was set */
-
         PRINT_BUF(4, (ss, "client, found session-id:", sid->u.ssl3.sessionID,
                       sid->u.ssl3.sessionIDLength));
 
         ss->ssl3.policy = sid->u.ssl3.policy;
     } else {
         SSL_AtomicIncrementLong(& ssl3stats.sch_sid_cache_misses );
 
-        rv = ssl3_NegotiateVersion(ss, SSL_LIBRARY_VERSION_3_1_TLS);
+        rv = ssl3_NegotiateVersion(ss, SSL_LIBRARY_VERSION_MAX_SUPPORTED,
+                                   PR_TRUE);
         if (rv != SECSuccess)
             return rv;  /* error code was set */
 
         sid = ssl3_NewSessionID(ss, PR_FALSE);
         if (!sid) {
             return SECFailure;  /* memory error is set */
         }
     }
 
     isTLS = (ss->version > SSL_LIBRARY_VERSION_3_0);
     ssl_GetSpecWriteLock(ss);
     cwSpec = ss->ssl3.cwSpec;
     if (cwSpec->mac_def->mac == mac_null) {
         /* SSL records are not being MACed. */
         cwSpec->version = ss->version;
     }
     ssl_ReleaseSpecWriteLock(ss);
 
     if (ss->sec.ci.sid != NULL) {
         ssl_FreeSID(ss->sec.ci.sid);    /* decrement ref count, free if zero */
     }
     ss->sec.ci.sid = sid;
 
     ss->sec.send = ssl3_SendApplicationData;
 
     /* shouldn't get here if SSL3 is disabled, but ... */
-    PORT_Assert(ss->opt.enableSSL3 || ss->opt.enableTLS);
-    if (!ss->opt.enableSSL3 && !ss->opt.enableTLS) {
+    if (SSL3_ALL_VERSIONS_DISABLED(&ss->vrange)) {
+        PR_NOT_REACHED("No versions of SSL 3.0 or later are enabled");
         PORT_SetError(SSL_ERROR_SSL_DISABLED);
         return SECFailure;
     }
 
     /* how many suites does our PKCS11 support (regardless of policy)? */
     num_suites = ssl3_config_match_init(ss);
     if (!num_suites)
         return SECFailure;      /* ssl3_config_match_init has set error code. */
 
     /* HACK for SCSV in SSL 3.0.  On initial handshake, prepend SCSV,
@@ skipping 1049 matching lines @@
        ss->ssl3.platformClientKey = (PlatformKey)NULL;
     }
 #endif  /* NSS_PLATFORM_CLIENT_AUTH */
 
     temp = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length);
     if (temp < 0) {
         goto loser;     /* alert has been sent */
     }
     version = (SSL3ProtocolVersion)temp;
 
-    /* this is appropriate since the negotiation is complete, and we only
-    ** know SSL 3.x.
-    */
-    if (MSB(version) != MSB(SSL_LIBRARY_VERSION_3_0)) {
-        desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version 
-                                                   : handshake_failure;
-        goto alert_loser;
-    }
-
-    rv = ssl3_NegotiateVersion(ss, version);
+    rv = ssl3_NegotiateVersion(ss, version, PR_FALSE);
     if (rv != SECSuccess) {
         desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version 
                                                    : handshake_failure;
         errCode = SSL_ERROR_NO_CYPHER_OVERLAP;
         goto alert_loser;
     }
     isTLS = (ss->version > SSL_LIBRARY_VERSION_3_0);
 
     rv = ssl3_ConsumeHandshake(
         ss, &ss->ssl3.hs.server_random, SSL3_RANDOM_LENGTH, &b, &length);
@@ skipping 1253 matching lines @@
         desc    = no_renegotiation;
         level   = alert_warning;
         errCode = SSL_ERROR_RENEGOTIATION_NOT_ALLOWED;
         goto alert_loser;
     }
 
     tmp = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length);
     if (tmp < 0)
         goto loser;             /* malformed, alert already sent */
     ss->clientHelloVersion = version = (SSL3ProtocolVersion)tmp;
-    rv = ssl3_NegotiateVersion(ss, version);
+    rv = ssl3_NegotiateVersion(ss, version, PR_TRUE);
     if (rv != SECSuccess) {
         desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version 
                                                    : handshake_failure;
         errCode = SSL_ERROR_NO_CYPHER_OVERLAP;
         goto alert_loser;
     }
 
     /* grab the client random data. */
     rv = ssl3_ConsumeHandshake(
         ss, &ss->ssl3.hs.client_random, SSL3_RANDOM_LENGTH, &b, &length);
@@ skipping 687 matching lines @@
         errCode = SSL_ERROR_RX_UNEXPECTED_CLIENT_HELLO;
         goto loser;     /* alert_loser */
     }
 
     version      = (buffer[1] << 8) | buffer[2];
     suite_length = (buffer[3] << 8) | buffer[4];
     sid_length   = (buffer[5] << 8) | buffer[6];
     rand_length  = (buffer[7] << 8) | buffer[8];
     ss->clientHelloVersion = version;
 
-    rv = ssl3_NegotiateVersion(ss, version);
+    rv = ssl3_NegotiateVersion(ss, version, PR_TRUE);
     if (rv != SECSuccess) {
         /* send back which ever alert client will understand. */
         desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version : handshake_failure;
         errCode = SSL_ERROR_NO_CYPHER_OVERLAP;
         goto alert_loser;
     }
 
     /* if we get a non-zero SID, just ignore it. */
     if (length !=
         SSL_HL_CLIENT_HELLO_HBYTES + suite_length + sid_length + rand_length) {
@@ skipping 215 matching lines @@
         return rv;      /* err set by ssl3_SetupPendingCipherSpec */
     }
 
     return SECSuccess;
 }
 
 
 static SECStatus
 ssl3_SendServerKeyExchange(sslSocket *ss)
 {
-const ssl3KEADef *     kea_def     = ss->ssl3.hs.kea_def;
+    const ssl3KEADef * kea_def     = ss->ssl3.hs.kea_def;
     SECStatus          rv          = SECFailure;
     int                length;
     PRBool             isTLS;
     SECItem            signed_hash = {siBuffer, NULL, 0};
     SSL3Hashes         hashes;
     SECKEYPublicKey *  sdPub;   /* public key for step-down */
 
     SSL_TRC(3, ("%d: SSL3[%d]: send server_key_exchange handshake",
                 SSL_GETPID(), ss->fd));
 
@@ skipping 78 matching lines @@
         PORT_Free(signed_hash.data);
     return SECFailure;
 }
 
 
 static SECStatus
 ssl3_SendCertificateRequest(sslSocket *ss)
 {
     SECItem *      name;
     CERTDistNames *ca_list;
-const uint8 *      certTypes;
+    const uint8 *  certTypes;
     SECItem *      names        = NULL;
     SECStatus      rv;
     int            length;
     int            i;
     int            calen        = 0;
     int            nnames       = 0;
     int            certTypesLength;
 
     SSL_TRC(3, ("%d: SSL3[%d]: send certificate_request handshake",
                 SSL_GETPID(), ss->fd));
@@ skipping 327 matching lines @@
 
 /* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
  * ssl3 ClientKeyExchange message from the remote client
  * Caller must hold Handshake and RecvBuf locks.
  */
 static SECStatus
 ssl3_HandleClientKeyExchange(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
 {
     SECKEYPrivateKey *serverKey         = NULL;
     SECStatus         rv;
-const ssl3KEADef *    kea_def;
+    const ssl3KEADef *kea_def;
     ssl3KeyPair     *serverKeyPair      = NULL;
 #ifdef NSS_ENABLE_ECC
     SECKEYPublicKey *serverPubKey       = NULL;
 #endif /* NSS_ENABLE_ECC */
 
     SSL_TRC(3, ("%d: SSL3[%d]: handle client_key_exchange handshake",
                 SSL_GETPID(), ss->fd));
 
     PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
     PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
@@ skipping 774 matching lines @@
         rv = SECSuccess;
     }
 
 done:
     ssl_ReleaseSSL3HandshakeLock(ss);
     ssl_ReleaseRecvBufLock(ss);
 
     return rv;
 }
 
+static SECStatus
+ssl3_ComputeTLSFinished(ssl3CipherSpec *spec,
+                        PRBool          isServer,
+                const   SSL3Finished *  hashes,
+                        TLSFinished  *  tlsFinished)
+{
+    const char * label;
+    unsigned int len;
+    SECStatus    rv;
+
+    label = isServer ? "server finished" : "client finished";
+    len   = 15;
+
+    rv = ssl3_TLSPRFWithMasterSecret(spec, label, len, hashes->md5,
+        sizeof *hashes, tlsFinished->verify_data,
+        sizeof tlsFinished->verify_data);
+
+    return rv;
+}
+
 /* The calling function must acquire and release the appropriate
  * lock (e.g., ssl_GetSpecReadLock / ssl_ReleaseSpecReadLock for
  * ss->ssl3.crSpec).
  */
 SECStatus
 ssl3_TLSPRFWithMasterSecret(ssl3CipherSpec *spec, const char *label,
     unsigned int labelLen, const unsigned char *val, unsigned int valLen,
     unsigned char *out, unsigned int outLen)
 {
     SECStatus rv = SECSuccess;
@@ skipping 24 matching lines @@
         inData.data  = (unsigned char *) val;
         inData.len   = valLen;
         outData.data = out;
         outData.len  = outLen;
         rv = TLS_PRF(&spec->msItem, label, &inData, &outData, isFIPS);
         PORT_Assert(rv != SECSuccess || outData.len == outLen);
     }
     return rv;
 }
 
-static SECStatus
-ssl3_ComputeTLSFinished(ssl3CipherSpec *spec,
-                        PRBool          isServer,
-                const   SSL3Finished *  hashes,
-                        TLSFinished  *  tlsFinished)
-{
-    const char * label;
-    unsigned int len;
-    SECStatus    rv;
-
-    label = isServer ? "server finished" : "client finished";
-    len   = 15;
-
-    rv = ssl3_TLSPRFWithMasterSecret(spec, label, len, hashes->md5,
-        sizeof *hashes, tlsFinished->verify_data,
-        sizeof tlsFinished->verify_data);
-
-    return rv;
-}
-
 /* called from ssl3_HandleServerHelloDone
  */
 static SECStatus
 ssl3_SendNextProto(sslSocket *ss)
 {
     SECStatus rv;
     int padding_len;
     static const unsigned char padding[32] = {0};
 
     if (ss->ssl3.nextProto.len == 0)
@@ skipping 353 matching lines @@
         return SECWouldBlock;
     }
 
     rv = ssl3_FinishHandshake(ss);
     return rv;
 }
 
 SECStatus
 ssl3_FinishHandshake(sslSocket * ss)
 {
-    SECStatus rv;
-
     PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
     PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
     PORT_Assert( ss->ssl3.hs.restartTarget == NULL );
 
     /* The first handshake is now completed. */
     ss->handshake           = NULL;
     ss->firstHsDone         = PR_TRUE;
 
-    if (ss->sec.ci.sid->cached == never_cached &&
-        !ss->opt.noCache && ss->sec.cache && ss->ssl3.hs.cacheSID) {
+    if (ss->ssl3.hs.cacheSID) {
         (*ss->sec.cache)(ss->sec.ci.sid);
+        ss->ssl3.hs.cacheSID = PR_FALSE;
     }
 
     ss->ssl3.hs.ws = idle_handshake;
 
     /* Do the handshake callback for sslv3 here, if we cannot false start. */
     if (ss->handshakeCallback != NULL && !ssl3_CanFalseStart(ss)) {
         (ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData);
     }
 
     return SECSuccess;
@@ skipping 356 matching lines @@
  *
  * Caller must hold the RecvBufLock.
  *
  * This function aquires and releases the SSL3Handshake Lock, holding the
  * lock around any calls to functions that handle records other than
  * Application Data records.
  */
 SECStatus
 ssl3_HandleRecord(sslSocket *ss, SSL3Ciphertext *cText, sslBuffer *databuf)
 {
-const ssl3BulkCipherDef *cipher_def;
+    const ssl3BulkCipherDef *cipher_def;
     ssl3CipherSpec *     crSpec;
     SECStatus            rv;
-    unsigned int         hashBytes              = MAX_MAC_LENGTH + 1;
+    unsigned int         hashBytes = MAX_MAC_LENGTH + 1;
     unsigned int         padding_length;
     PRBool               isTLS;
-    PRBool               padIsBad               = PR_FALSE;
+    PRBool               padIsBad = PR_FALSE;
     SSL3ContentType      rType;
     SSL3Opaque           hash[MAX_MAC_LENGTH];
     sslBuffer           *plaintext;
     sslBuffer            temp_buf;
+    unsigned int         ivLen = 0;
 
     PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
 
     if (!ss->ssl3.initialized) {
         ssl_GetSSL3HandshakeLock(ss);
         rv = ssl3_InitState(ss);
         ssl_ReleaseSSL3HandshakeLock(ss);
         if (rv != SECSuccess) {
             return rv;          /* ssl3_InitState has set the error code. */
         }
@@ skipping 12 matching lines @@
     if (cText == NULL) {
         SSL_DBG(("%d: SSL3[%d]: HandleRecord, resuming handshake",
                  SSL_GETPID(), ss->fd));
         rType = content_handshake;
         goto process_it;
     }
 
     ssl_GetSpecReadLock(ss); /******************************************/
 
     crSpec = ss->ssl3.crSpec;
+    cipher_def = crSpec->cipher_def;
+
+    if (cipher_def->type == type_block &&
+        crSpec->version >= SSL_LIBRARY_VERSION_TLS_1_1) {
+        /* Consume the per-record explicit IV. RFC 4346 Section 6.2.3.2 states
+         * "The receiver decrypts the entire GenericBlockCipher structure and
+         * then discards the first cipher block corresponding to the IV
+         * component." Instead, we decrypt the first cipher block and then
+         * discard it before decrypting the rest.

[Ryan Sleevi, 2012/03/19 22:15:50]

Really?

Does this have any timing side-effects?

[wtc, 2012/03/20 21:15:09]

I think the use of "Instead" in this comment is a little
confusing.

We are doing what the RFC recommends.  We are
decrypting the entire GenericBlockCipher structure.
To avoid creatign a new NSS decryption context
(crSpec->decodeContext) for the new IV, we decrypt the IV
using the existing NSS decryption context.  The decrypted
output is garbage because the IV is decrypted using the
"CBC residue" in the NSS decryption context, but it has
the desired side effect of making the IV become the next
CBC residue.

We direct the output of the first crSpec->decode() to a
separate buffer (the 'iv' local variable) so that it can be
discarded easily.
There should be no timing side effects because we do the
same thing regardless of the value of the IV.

+         */
+        SSL3Opaque iv[MAX_IV_LENGTH];
+        int decoded;
+
+        ivLen = cipher_def->iv_size;
+        if (ivLen < 8 || ivLen > sizeof(iv)) {
+            ssl_ReleaseSpecReadLock(ss);
+            PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
+            return SECFailure;
+        }
+        if (ivLen > cText->buf->len) {
+            SSL_DBG(("%d: SSL3[%d]: HandleRecord, IV length check failed",
+                     SSL_GETPID(), ss->fd));
+            /* must not hold spec lock when calling SSL3_SendAlert. */
+            ssl_ReleaseSpecReadLock(ss);
+            SSL3_SendAlert(ss, alert_fatal, bad_record_mac);
+            /* always log mac error, in case attacker can read server logs. */
+            PORT_SetError(SSL_ERROR_BAD_MAC_READ);

[Ryan Sleevi, 2012/03/19 22:15:50]

Can't they also measure timing?

[wtc, 2012/03/20 21:15:09]

Should I remove this comment?  I copied this comment from
the code below that handles a real decryption failure.
Here the decryption fails because the ciphertext does not
even have enough bytes for the IV block.  I also think it is
safe to set the SSL_ERROR_DECRYPTION_FAILURE error here.

[wtc, 2012/03/20 21:36:55]

If you could suggest better wording for that comment, I'd
appreciate it.  I was confused by the "Instead" in that
comment.  It seems to imply a complete deviation from the
RFC recommendation, but actually we only take a slightly
different approach to accomplish the same effect more
efficiently.

+            return SECFailure;
+        }
+
+        PRINT_BUF(80, (ss, "IV (ciphertext):", cText->buf->buf, ivLen));
+
+        /* The decryption result is garbage, but since we just throw away
+         * the block it doesn't matter.  The decryption of the next block
+         * depends only on the ciphertext of the IV block.
+         */
+        rv = crSpec->decode(crSpec->decodeContext, iv, &decoded,
+                            sizeof(iv), cText->buf->buf, ivLen);
+
+        if (rv != SECSuccess) {
+            /* All decryption failures must be treated like a bad record
+             * MAC; see RFC 5246 (TLS 1.2). 
+             */
+            padIsBad = PR_TRUE;
+        }
+    }
 
     /* If we will be decompressing the buffer we need to decrypt somewhere
      * other than into databuf */
     if (crSpec->decompressor) {
         temp_buf.buf = NULL;
         temp_buf.space = 0;
         plaintext = &temp_buf;
     } else {
         plaintext = databuf;
     }
 
     plaintext->len = 0; /* filled in by decode call below. */
     if (plaintext->space < MAX_FRAGMENT_LENGTH) {
         rv = sslBuffer_Grow(plaintext, MAX_FRAGMENT_LENGTH + 2048);
         if (rv != SECSuccess) {
             ssl_ReleaseSpecReadLock(ss);
             SSL_DBG(("%d: SSL3[%d]: HandleRecord, tried to get %d bytes",
                      SSL_GETPID(), ss->fd, MAX_FRAGMENT_LENGTH + 2048));
             /* sslBuffer_Grow has set a memory error code. */
             /* Perhaps we should send an alert. (but we have no memory!) */
             return SECFailure;
         }
     }
 
-    PRINT_BUF(80, (ss, "ciphertext:", cText->buf->buf, cText->buf->len));
+    PRINT_BUF(80, (ss, "ciphertext:", cText->buf->buf + ivLen,
+                                      cText->buf->len - ivLen));
 
-    cipher_def = crSpec->cipher_def;
     isTLS = (PRBool)(crSpec->version > SSL_LIBRARY_VERSION_3_0);
 
-    if (isTLS && cText->buf->len > (MAX_FRAGMENT_LENGTH + 2048)) {
+    if (isTLS && cText->buf->len - ivLen > (MAX_FRAGMENT_LENGTH + 2048)) {
         ssl_ReleaseSpecReadLock(ss);
         SSL3_SendAlert(ss, alert_fatal, record_overflow);
         PORT_SetError(SSL_ERROR_RX_RECORD_TOO_LONG);
         return SECFailure;
     }
 
     /* decrypt from cText buf to plaintext. */
     rv = crSpec->decode(
         crSpec->decodeContext, plaintext->buf, (int *)&plaintext->len,
-        plaintext->space, cText->buf->buf, cText->buf->len);
+        plaintext->space, cText->buf->buf + ivLen, cText->buf->len - ivLen);
 
     PRINT_BUF(80, (ss, "cleartext:", plaintext->buf, plaintext->len));
     if (rv != SECSuccess) {
         /* All decryption failures must be treated like a bad record
          * MAC; see RFC 5246 (TLS 1.2). 
          */
         padIsBad = PR_TRUE;
     }
 
     /* If it's a block cipher, check and strip the padding. */
@@ skipping 205 matching lines @@
     spec->server.write_key         = NULL;
     spec->server.write_mac_key     = NULL;
     spec->server.write_mac_context = NULL;
 
     spec->write_seq_num.high       = 0;
     spec->write_seq_num.low        = 0;
 
     spec->read_seq_num.high        = 0;
     spec->read_seq_num.low         = 0;
 
-    spec->version                  = ss->opt.enableTLS
-                                          ? SSL_LIBRARY_VERSION_3_1_TLS
-                                          : SSL_LIBRARY_VERSION_3_0;
+    spec->version                  = ss->vrange.max;
 }
 
 /* Called from: ssl3_SendRecord
 **              ssl3_StartHandshakeHash() <- ssl2_BeginClientHandshake()
 **              ssl3_SendClientHello()
 **              ssl3_HandleServerHello()
 **              ssl3_HandleClientHello()
 **              ssl3_HandleV2ClientHello()
 **              ssl3_HandleRecord()
 **
@@ skipping 224 matching lines @@
 SECStatus
 ssl3_ConstructV2CipherSpecsHack(sslSocket *ss, unsigned char *cs, int *size)
 {
     int i, count = 0;
 
     PORT_Assert(ss != 0);
     if (!ss) {
         PORT_SetError(PR_INVALID_ARGUMENT_ERROR);
         return SECFailure;
     }
-    if (!ss->opt.enableSSL3 && !ss->opt.enableTLS) {
+    if (SSL3_ALL_VERSIONS_DISABLED(&ss->vrange)) {
         *size = 0;
         return SECSuccess;
     }
     if (cs == NULL) {
         *size = count_cipher_suites(ss, SSL_ALLOWED, PR_TRUE);
         return SECSuccess;
     }
 
     /* ssl3_config_match_init was called by the caller of this function. */
     for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) {
@@ skipping 107 matching lines @@
     /* free up the CipherSpecs */
     ssl3_DestroyCipherSpec(&ss->ssl3.specs[0], PR_TRUE/*freeSrvName*/);
     ssl3_DestroyCipherSpec(&ss->ssl3.specs[1], PR_TRUE/*freeSrvName*/);
 
     ss->ssl3.initialized = PR_FALSE;
 
     SECITEM_FreeItem(&ss->ssl3.nextProto, PR_FALSE);
 }
 
 /* End of ssl3con.c */