OpenSSL: add support for the TLS padding extension.

openssl/ssl/t1_lib.c

 /* ssl/t1_lib.c */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
  * This package is an SSL implementation written
  * by Eric Young (eay@cryptsoft.com).
  * The implementation was written so as to conform with Netscapes SSL.
  * 
  * This library is free for commercial and non-commercial use as long as
  * the following conditions are aheared to.  The following conditions
@@ skipping 643 matching lines @@
 
                 if(ssl_add_clienthello_use_srtp_ext(s, ret, &el, el))
                         {
                         SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
                         return NULL;
                         }
                 ret += el;
                 }
 #endif
 
+        /* Add padding to workaround bugs in F5 terminators.
+         * See https://tools.ietf.org/html/draft-agl-tls-padding-02 */
+        {
+        int hlen = ret - (unsigned char *)s->init_buf->data;
+        /* The code in s23_clnt.c to build ClientHello messages includes the
+         * 5-byte record header in the buffer, while the code in s3_clnt.c does
+         * not. */

[digit1, 2013/12/12 17:02:28]

That's really subtle. Is this per-spec/per-protocol or an implementation detail?
If the latter, how about adding a comment in the appropriate places to avoid
breaking this if the sources are independently modified in the future?

[agl, 2013/12/16 19:44:19]

This is sadly an implementation niggle. I've added comments at the sites where
the buffers are setup about the subtle dependency.

+        if (s->state == SSL23_ST_CW_CLNT_HELLO_A)
+                hlen -= 5;
+        if (hlen > 0xff && hlen < 0x200)
+                {
+                hlen = 0x200 - hlen;
+                if (hlen >= 4)
+                        hlen -= 4;
+                else
+                        hlen = 0;
+
+                s2n(TLSEXT_TYPE_padding, ret);
+                s2n(hlen, ret);
+                memset(ret, 0, hlen);
+                ret += hlen;
+                }
+        }
+
+
         if ((extdatalen = ret-p-2)== 0) 
                 return p;
 
         s2n(extdatalen,p);
         return ret;
         }
 
 unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
         {
         int extdatalen=0;
@@ skipping 1982 matching lines @@
                         continue;
                 EVP_MD_CTX_copy_ex(&ctx, s->s3->handshake_dgst[i]);
                 EVP_DigestFinal_ex(&ctx, temp_digest, &temp_digest_len);
                 EVP_DigestUpdate(md, temp_digest, temp_digest_len);
                 }
         EVP_MD_CTX_cleanup(&ctx);
 
         return 1;
         }
 #endif