Make the AES-GCM cipher suites work in DTLS, by moving the

net/third_party/nss/ssl/ssl3con.c

 /* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
 /*
  * SSL3 Protocol
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /* TODO(ekr): Implement HelloVerifyRequest on server side. OK for now. */
 
@@ skipping 67 matching lines @@
 static SECStatus ssl3_FlushHandshakeMessages(sslSocket *ss, PRInt32 flags);
 static int       ssl3_OIDToTLSHashAlgorithm(SECOidTag oid);
 
 static SECStatus Null_Cipher(void *ctx, unsigned char *output, int *outputLen,
                              int maxOutputLen, const unsigned char *input,
                              int inputLen);
 #ifndef NO_PKCS11_BYPASS
 static SECStatus ssl3_AESGCMBypass(ssl3KeyMaterial *keys, PRBool doDecrypt,
                                    unsigned char *out, int *outlen, int maxout,
                                    const unsigned char *in, int inlen,
-                                   SSL3ContentType type,
-                                   SSL3ProtocolVersion version,
-                                   SSL3SequenceNumber seq_num);
+                                   const unsigned char *additionalData,
+                                   int additionalDataLen);
 #endif
 
 #define MAX_SEND_BUF_LENGTH 32000 /* watch for 16-bit integer overflow */
 #define MIN_SEND_BUF_LENGTH  4000
 
 /* This list of SSL3 cipher suites is sorted in descending order of
  * precedence (desirability).  It only includes cipher suites we implement.
  * This table is modified by SSL3_SetPolicy(). The ordering of cipher suites
  * in this table must match the ordering in SSL_ImplementedCiphers (sslenum.c)
  */
@@ skipping 288 matching lines @@
      cipher_camellia_256, mac_sha, kea_dhe_rsa},
 
     {TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA,
                                     cipher_des,    mac_sha,kea_rsa_export_1024},
     {TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,
                                     cipher_rc4_56, mac_sha,kea_rsa_export_1024},
 
     {SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, kea_rsa_fips},
     {SSL_RSA_FIPS_WITH_DES_CBC_SHA, cipher_des,    mac_sha, kea_rsa_fips},
 
-    {TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_null, kea_dhe_rsa},
-    {TLS_RSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_null, kea_rsa},
-    {TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_null, kea_ecdhe_rsa},
-    {TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_null, kea_ecdhe_ecdsa},
+    {TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_aead, kea_dhe_rsa},
+    {TLS_RSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_aead, kea_rsa},
+    {TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_aead, kea_ecdhe_rsa},
+    {TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_aead, kea_ecdhe_ecdsa},
 
 #ifdef NSS_ENABLE_ECC
     {TLS_ECDH_ECDSA_WITH_NULL_SHA,        cipher_null, mac_sha, kea_ecdh_ecdsa},
     {TLS_ECDH_ECDSA_WITH_RC4_128_SHA,      cipher_rc4, mac_sha, kea_ecdh_ecdsa},
     {TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, kea_ecdh_ecdsa},
     {TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_ecdh_ecdsa},
     {TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_ecdh_ecdsa},
 
     {TLS_ECDHE_ECDSA_WITH_NULL_SHA,        cipher_null, mac_sha, kea_ecdhe_ecdsa},
     {TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,      cipher_rc4, mac_sha, kea_ecdhe_ecdsa},
@@ skipping 54 matching lines @@
     { calg_aes_gcm  , CKM_AES_GCM                       },
 /*  { calg_init     , (CK_MECHANISM_TYPE)0x7fffffffL    }  */
 };
 
 #define mmech_null     (CK_MECHANISM_TYPE)0x80000000L
 #define mmech_md5      CKM_SSL3_MD5_MAC
 #define mmech_sha      CKM_SSL3_SHA1_MAC
 #define mmech_md5_hmac CKM_MD5_HMAC
 #define mmech_sha_hmac CKM_SHA_1_HMAC
 #define mmech_sha256_hmac CKM_SHA256_HMAC
+#define mmech_sha384_hmac CKM_SHA384_HMAC
+#define mmech_sha512_hmac CKM_SHA512_HMAC
 
 static const ssl3MACDef mac_defs[] = { /* indexed by SSL3MACAlgorithm */
     /* pad_size is only used for SSL 3.0 MAC. See RFC 6101 Sec. 5.2.3.1. */
     /* mac      mmech       pad_size  mac_size                       */
     { mac_null, mmech_null,       0,  0          },
     { mac_md5,  mmech_md5,       48,  MD5_LENGTH },
     { mac_sha,  mmech_sha,       40,  SHA1_LENGTH},
     {hmac_md5,  mmech_md5_hmac,   0,  MD5_LENGTH },
     {hmac_sha,  mmech_sha_hmac,   0,  SHA1_LENGTH},
     {hmac_sha256, mmech_sha256_hmac, 0, SHA256_LENGTH},
+    {hmac_sha384, mmech_sha384_hmac, 0, SHA384_LENGTH},
+    {hmac_sha512, mmech_sha512_hmac, 0, SHA512_LENGTH},
+    { mac_aead, mmech_null,       0,  0          },

[wtc, 2013/08/17 00:21:15]

This array element for mac_aead needs to exist but won't be used for AEAD
ciphers. So the fields of this array element have invalid/0 values.

 };
 
 /* indexed by SSL3BulkCipher */
 const char * const ssl3_cipherName[] = {
     "NULL",
     "RC4",
     "RC4-40",
     "RC4-56",
     "RC2-CBC",
     "RC2-CBC-40",
@@ skipping 1262 matching lines @@
         case CKM_RC2_MAC:
         case CKM_RC2_MAC_GENERAL:
         case CKM_RC2_CBC_PAD:
             *(CK_RC2_PARAMS *)param->data = ulEffectiveBits;
         default: break;
         }
     }
     return param;
 }
 
-/* ssl3_BuildRecordPseudoHeader writes the TLS pseudo-header (the data which
- * is included in the MAC) to |out| and returns its length. */
+/* ssl3_BuildRecordPseudoHeader writes the SSL/TLS pseudo-header (the data
+ * which is included in the MAC or AEAD additional data) to |out| and returns
+ * its length. See https://tools.ietf.org/html/rfc5246#section-6.2.3.3 for the
+ * definition of the AEAD additional data.
+ *
+ * TLS pseudo-header includes the record's version field, SSL's doesn't. Which
+ * pseudo-header defintiion to use should be decided based on the version of
+ * the protocol that was negotiated when the spec became current, NOT based on
+ * the version value in the record itself, and the decision is passed to this
+ * function as the |includesVersion| argument. But, the |version| argument
+ * should be the record's version value.
+ */
 static unsigned int
 ssl3_BuildRecordPseudoHeader(unsigned char *out,
                              SSL3SequenceNumber seq_num,
                              SSL3ContentType type,
                              PRBool includesVersion,
                              SSL3ProtocolVersion version,
                              PRBool isDTLS,
                              int length)
 {
     out[0] = (unsigned char)(seq_num.high >> 24);
@@ skipping 93 matching lines @@
 }
 
 static SECStatus
 ssl3_AESGCM(ssl3KeyMaterial *keys,
             PRBool doDecrypt,
             unsigned char *out,
             int *outlen,
             int maxout,
             const unsigned char *in,
             int inlen,
-            SSL3ContentType type,
-            SSL3ProtocolVersion version,
-            SSL3SequenceNumber seq_num)
+            const unsigned char *additionalData,
+            int additionalDataLen)
 {
     SECItem            param;
     SECStatus          rv = SECFailure;
     unsigned char      nonce[12];
-    unsigned char      additionalData[13];
-    unsigned int       additionalDataLen;
     unsigned int       uOutLen;
     CK_GCM_PARAMS      gcmParams;
 
     static const int   tagSize = 16;
     static const int   explicitNonceLen = 8;
 
-    /* See https://tools.ietf.org/html/rfc5246#section-6.2.3.3 for the
-     * definition of the AEAD additional data. */
-    additionalDataLen = ssl3_BuildRecordPseudoHeader(
-        additionalData, seq_num, type, PR_TRUE /* includes version */,
-        version, PR_FALSE /* not DTLS */,

[wtc, 2013/08/17 00:21:15]

Note that we had to pass PR_FALSE as the |isDTLS| argument here because we
don't have that boolean available here.

-        inlen - (doDecrypt ? explicitNonceLen + tagSize : 0));
-    PORT_Assert(additionalDataLen <= sizeof(additionalData));
-
     /* See https://tools.ietf.org/html/rfc5288#section-3 for details of how the
      * nonce is formed. */
     memcpy(nonce, keys->write_iv, 4);
     if (doDecrypt) {
         memcpy(nonce + 4, in, explicitNonceLen);
         in += explicitNonceLen;
         inlen -= explicitNonceLen;
         *outlen = 0;
     } else {
         if (maxout < explicitNonceLen) {
             PORT_SetError(SEC_ERROR_INPUT_LEN);
             return SECFailure;
         }
         /* Use the 64-bit sequence number as the explicit nonce. */
         memcpy(nonce + 4, additionalData, explicitNonceLen);
         memcpy(out, additionalData, explicitNonceLen);
         out += explicitNonceLen;
         maxout -= explicitNonceLen;
         *outlen = explicitNonceLen;
     }
 
     param.type = siBuffer;
     param.data = (unsigned char *) &gcmParams;
     param.len = sizeof(gcmParams);
     gcmParams.pIv = nonce;
     gcmParams.ulIvLen = sizeof(nonce);
-    gcmParams.pAAD = additionalData;
+    gcmParams.pAAD = (unsigned char *)additionalData;  /* const cast */
     gcmParams.ulAADLen = additionalDataLen;
     gcmParams.ulTagBits = tagSize * 8;
 
     if (doDecrypt) {
         rv = pk11_decrypt(keys->write_key, CKM_AES_GCM, &param, out, &uOutLen,
                           maxout, in, inlen);
     } else {
         rv = pk11_encrypt(keys->write_key, CKM_AES_GCM, &param, out, &uOutLen,
                           maxout, in, inlen);
     }
     *outlen += (int) uOutLen;
 
     return rv;
 }
 
 #ifndef NO_PKCS11_BYPASS
 static SECStatus
 ssl3_AESGCMBypass(ssl3KeyMaterial *keys,
                   PRBool doDecrypt,
                   unsigned char *out,
                   int *outlen,
                   int maxout,
                   const unsigned char *in,
                   int inlen,
-                  SSL3ContentType type,
-                  SSL3ProtocolVersion version,
-                  SSL3SequenceNumber seq_num)
+                  const unsigned char *additionalData,
+                  int additionalDataLen)
 {
     SECStatus          rv = SECFailure;
     unsigned char      nonce[12];
-    unsigned char      additionalData[13];
-    unsigned int       additionalDataLen;
     unsigned int       uOutLen;
     AESContext        *cx;
     CK_GCM_PARAMS      gcmParams;
 
     static const int   tagSize = 16;
     static const int   explicitNonceLen = 8;
 
-    /* See https://tools.ietf.org/html/rfc5246#section-6.2.3.3 for the
-     * definition of the AEAD additional data. */
-    additionalDataLen = ssl3_BuildRecordPseudoHeader(
-        additionalData, seq_num, type, PR_TRUE /* includes version */,
-        version, PR_FALSE /* not DTLS */,
-        inlen - (doDecrypt ? explicitNonceLen + tagSize : 0));
-    PORT_Assert(additionalDataLen <= sizeof(additionalData));
-
     /* See https://tools.ietf.org/html/rfc5288#section-3 for details of how the
      * nonce is formed. */
     PORT_Assert(keys->write_iv_item.len == 4);
     if (keys->write_iv_item.len != 4) {
         PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
         return SECFailure;
     }
     memcpy(nonce, keys->write_iv_item.data, 4);
     if (doDecrypt) {
         memcpy(nonce + 4, in, explicitNonceLen);
         in += explicitNonceLen;
         inlen -= explicitNonceLen;
         *outlen = 0;
     } else {
         if (maxout < explicitNonceLen) {
             PORT_SetError(SEC_ERROR_INPUT_LEN);
             return SECFailure;
         }
         /* Use the 64-bit sequence number as the explicit nonce. */
         memcpy(nonce + 4, additionalData, explicitNonceLen);
         memcpy(out, additionalData, explicitNonceLen);
         out += explicitNonceLen;
         maxout -= explicitNonceLen;
         *outlen = explicitNonceLen;
     }
 
     gcmParams.pIv = nonce;
     gcmParams.ulIvLen = sizeof(nonce);
-    gcmParams.pAAD = additionalData;
+    gcmParams.pAAD = (unsigned char *)additionalData;  /* const cast */
     gcmParams.ulAADLen = additionalDataLen;
     gcmParams.ulTagBits = tagSize * 8;
 
     cx = (AESContext *)keys->cipher_context;
     rv = AES_InitContext(cx, keys->write_key_item.data,
                          keys->write_key_item.len,
                          (unsigned char *)&gcmParams, NSS_AES_GCM, !doDecrypt,
                          AES_BLOCK_SIZE);
     if (rv != SECSuccess) {
         return rv;
@@ skipping 280 matching lines @@
     0x5c, 0x5c, 0x5c, 0x5c
 };
 
 /* Called from: ssl3_SendRecord()
 ** Caller must already hold the SpecReadLock. (wish we could assert that!)
 */
 static SECStatus
 ssl3_ComputeRecordMAC(
     ssl3CipherSpec *   spec,
     PRBool             useServerMacKey,
-    PRBool             isDTLS,
-    SSL3ContentType    type,
-    SSL3ProtocolVersion version,
-    SSL3SequenceNumber seq_num,
+    const unsigned char *header,
+    unsigned int       headerLen,
     const SSL3Opaque * input,
     int                inputLength,
     unsigned char *    outbuf,
     unsigned int *     outLength)
 {
     const ssl3MACDef * mac_def;
     SECStatus          rv;
-    PRBool             isTLS;
-    unsigned int       tempLen;
-    unsigned char      temp[MAX_MAC_LENGTH];

[wtc, 2013/08/17 00:21:15]

|isTLS| is only used once, so I just inline it.

I moved |tempLen| and |temp| to the block where they are used.

 
-    /* TLS MAC includes the record's version field, SSL's doesn't.
-    ** We decide which MAC defintiion to use based on the version of 
-    ** the protocol that was negotiated when the spec became current,
-    ** NOT based on the version value in the record itself.
-    ** But, we use the record's version value in the computation.
-    */
-    isTLS = spec->version > SSL_LIBRARY_VERSION_3_0;
-    tempLen = ssl3_BuildRecordPseudoHeader(temp, seq_num, type, isTLS,
-                                           version, isDTLS, inputLength);
-    PORT_Assert(tempLen <= sizeof(temp));
-
-    PRINT_BUF(95, (NULL, "frag hash1: temp", temp, tempLen));
+    PRINT_BUF(95, (NULL, "frag hash1: header", header, headerLen));
     PRINT_BUF(95, (NULL, "frag hash1: input", input, inputLength));
 
     mac_def = spec->mac_def;
     if (mac_def->mac == mac_null) {
         *outLength = 0;
         return SECSuccess;
     }
 #ifndef NO_PKCS11_BYPASS
     if (spec->bypassCiphers) {
         /* bypass version */
@@ skipping 24 matching lines @@
             break;
         default:
             break;
         }
         if (!hashObj) {
             PORT_Assert(0);
             PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
             return SECFailure;
         }
 
-        if (!isTLS) {
+        if (spec->version <= SSL_LIBRARY_VERSION_3_0) {
+            unsigned int tempLen;
+            unsigned char temp[MAX_MAC_LENGTH];
+
             /* compute "inner" part of SSL3 MAC */
             hashObj->begin(write_mac_context);
             if (useServerMacKey)
                 hashObj->update(write_mac_context, 
                                 spec->server.write_mac_key_item.data,
                                 spec->server.write_mac_key_item.len);
             else
                 hashObj->update(write_mac_context, 
                                 spec->client.write_mac_key_item.data,
                                 spec->client.write_mac_key_item.len);
             hashObj->update(write_mac_context, mac_pad_1, pad_bytes);
-            hashObj->update(write_mac_context, temp,  tempLen);
+            hashObj->update(write_mac_context, header, headerLen);
             hashObj->update(write_mac_context, input, inputLength);
             hashObj->end(write_mac_context,    temp, &tempLen, sizeof temp);
 
             /* compute "outer" part of SSL3 MAC */
             hashObj->begin(write_mac_context);
             if (useServerMacKey)
                 hashObj->update(write_mac_context, 
                                 spec->server.write_mac_key_item.data,
                                 spec->server.write_mac_key_item.len);
             else
@@ skipping 10 matching lines @@
                 rv = HMAC_Init(cx, hashObj, 
                                spec->server.write_mac_key_item.data,
                                spec->server.write_mac_key_item.len, PR_FALSE);
             } else {
                 rv = HMAC_Init(cx, hashObj, 
                                spec->client.write_mac_key_item.data,
                                spec->client.write_mac_key_item.len, PR_FALSE);
             }
             if (rv == SECSuccess) {
                 HMAC_Begin(cx);
-                HMAC_Update(cx, temp, tempLen);
+                HMAC_Update(cx, header, headerLen);
                 HMAC_Update(cx, input, inputLength);
                 rv = HMAC_Finish(cx, outbuf, outLength, spec->mac_size);
                 HMAC_Destroy(cx, PR_FALSE);
             }
 #undef cx
         }
     } else
 #endif
     {
         PK11Context *mac_context = 
             (useServerMacKey ? spec->server.write_mac_context
                              : spec->client.write_mac_context);
         rv  = PK11_DigestBegin(mac_context);
-        rv |= PK11_DigestOp(mac_context, temp, tempLen);
+        rv |= PK11_DigestOp(mac_context, header, headerLen);
         rv |= PK11_DigestOp(mac_context, input, inputLength);
         rv |= PK11_DigestFinal(mac_context, outbuf, outLength, spec->mac_size);
     }
 
     PORT_Assert(rv != SECSuccess || *outLength == (unsigned)spec->mac_size);
 
     PRINT_BUF(95, (NULL, "frag hash2: result", outbuf, *outLength));
 
     if (rv != SECSuccess) {
         rv = SECFailure;
@@ skipping 19 matching lines @@
 /* Called from: ssl3_HandleRecord()
  * Caller must already hold the SpecReadLock. (wish we could assert that!)
  *
  * On entry:
  *   originalLen >= inputLen >= MAC size
 */
 static SECStatus
 ssl3_ComputeRecordMACConstantTime(
     ssl3CipherSpec *   spec,
     PRBool             useServerMacKey,
-    PRBool             isDTLS,
-    SSL3ContentType    type,
-    SSL3ProtocolVersion version,
-    SSL3SequenceNumber seq_num,
+    const unsigned char *header,
+    unsigned int       headerLen,
     const SSL3Opaque * input,
     int                inputLen,
     int                originalLen,
     unsigned char *    outbuf,
     unsigned int *     outLen)
 {
     CK_MECHANISM_TYPE            macType;
     CK_NSS_MAC_CONSTANT_TIME_PARAMS params;
     PK11Context *                mac_context;
     SECItem                      param;
     SECStatus                    rv;
-    unsigned char                header[13];
     PK11SymKey *                 key;
-    int                          recordLength;
 
     PORT_Assert(inputLen >= spec->mac_size);
     PORT_Assert(originalLen >= inputLen);
 
     if (spec->bypassCiphers) {
         /* This function doesn't support PKCS#11 bypass. We fallback on the
          * non-constant time version. */
         goto fallback;
     }
 
     if (spec->mac_def->mac == mac_null) {
         *outLen = 0;
         return SECSuccess;
     }
 
-    header[0] = (unsigned char)(seq_num.high >> 24);
-    header[1] = (unsigned char)(seq_num.high >> 16);
-    header[2] = (unsigned char)(seq_num.high >>  8);
-    header[3] = (unsigned char)(seq_num.high >>  0);
-    header[4] = (unsigned char)(seq_num.low  >> 24);
-    header[5] = (unsigned char)(seq_num.low  >> 16);
-    header[6] = (unsigned char)(seq_num.low  >>  8);
-    header[7] = (unsigned char)(seq_num.low  >>  0);
-    header[8] = type;
-
     macType = CKM_NSS_HMAC_CONSTANT_TIME;
-    recordLength = inputLen - spec->mac_size;
     if (spec->version <= SSL_LIBRARY_VERSION_3_0) {
         macType = CKM_NSS_SSL3_MAC_CONSTANT_TIME;
-        header[9] = recordLength >> 8;
-        header[10] = recordLength;
-        params.ulHeaderLen = 11;
-    } else {
-        if (isDTLS) {
-            SSL3ProtocolVersion dtls_version;
-
-            dtls_version = dtls_TLSVersionToDTLSVersion(version);
-            header[9] = dtls_version >> 8;
-            header[10] = dtls_version;
-        } else {
-            header[9] = version >> 8;
-            header[10] = version;
-        }
-        header[11] = recordLength >> 8;
-        header[12] = recordLength;
-        params.ulHeaderLen = 13;
     }
 
     params.macAlg = spec->mac_def->mmech;
     params.ulBodyTotalLen = originalLen;
-    params.pHeader = header;
+    params.pHeader = (unsigned char *) header;  /* const cast */
+    params.ulHeaderLen = headerLen;
 
     param.data = (unsigned char*) &params;
     param.len = sizeof(params);
     param.type = 0;
 
     key = spec->server.write_mac_key;
     if (!useServerMacKey) {
         key = spec->client.write_mac_key;
     }
     mac_context = PK11_CreateContextBySymKey(macType, CKA_SIGN, key, &param);
@@ skipping 12 matching lines @@
     if (rv != SECSuccess) {
         rv = SECFailure;
         ssl_MapLowLevelError(SSL_ERROR_MAC_COMPUTATION_FAILURE);
     }
     return rv;
 
 fallback:
     /* ssl3_ComputeRecordMAC expects the MAC to have been removed from the
      * length already. */
     inputLen -= spec->mac_size;
-    return ssl3_ComputeRecordMAC(spec, useServerMacKey, isDTLS, type,
-                                 version, seq_num, input, inputLen,
-                                 outbuf, outLen);
+    return ssl3_ComputeRecordMAC(spec, useServerMacKey, header, headerLen,
+                                 input, inputLen, outbuf, outLen);
 }
 
 static PRBool
 ssl3_ClientAuthTokenPresent(sslSessionID *sid) {
     PK11SlotInfo *slot = NULL;
     PRBool isPresent = PR_TRUE;
 
     /* we only care if we are doing client auth */
     /* If NSS_PLATFORM_CLIENT_AUTH is defined and a platformClientKey is being
      * used, u.ssl3.clAuthValid will be false and this function will always
@@ skipping 31 matching lines @@
                               sslBuffer *        wrBuf)
 {
     const ssl3BulkCipherDef * cipher_def;
     SECStatus                 rv;
     PRUint32                  macLen = 0;
     PRUint32                  fragLen;
     PRUint32  p1Len, p2Len, oddLen = 0;
     PRUint16                  headerLen;
     int                       ivLen = 0;
     int                       cipherBytes = 0;
+    unsigned char             pseudoHeader[13];
+    unsigned int              pseudoHeaderLen;
 
     cipher_def = cwSpec->cipher_def;
     headerLen = isDTLS ? DTLS_RECORD_HEADER_LENGTH : SSL3_RECORD_HEADER_LENGTH;
 
     if (cipher_def->type == type_block &&
         cwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_1) {
         /* Prepend the per-record explicit IV using technique 2b from
          * RFC 4346 section 6.2.3.2: The IV is a cryptographically
          * strong random number XORed with the CBC residue from the previous
          * record.
@@ skipping 25 matching lines @@
         rv = cwSpec->compressor(
             cwSpec->compressContext,
             wrBuf->buf + headerLen + ivLen, &outlen,
             wrBuf->space - headerLen - ivLen, pIn, contentLen);
         if (rv != SECSuccess)
             return rv;
         pIn = wrBuf->buf + headerLen + ivLen;
         contentLen = outlen;
     }
 
+    pseudoHeaderLen = ssl3_BuildRecordPseudoHeader(pseudoHeader,

[Ryan Sleevi, 2013/08/17 02:00:23]

This is really weird indentation of that first param. Just $.02

[wtc, 2013/08/19 23:31:56]

Done.

+        cwSpec->write_seq_num, type,
+        cwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_0, cwSpec->version,
+        isDTLS, contentLen);
+    PORT_Assert(pseudoHeaderLen <= sizeof(pseudoHeader));
     if (cipher_def->type == type_aead) {
         const int nonceLen = cipher_def->explicit_nonce_size;
         const int tagLen = cipher_def->tag_size;
 
         if (headerLen + nonceLen + contentLen + tagLen > wrBuf->space) {
             PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
             return SECFailure;
         }
 
         cipherBytes = contentLen;
         rv = cwSpec->aead(
                 isServer ? &cwSpec->server : &cwSpec->client,
                 PR_FALSE,                                   /* do encrypt */
                 wrBuf->buf + headerLen,                     /* output  */
                 &cipherBytes,                               /* out len */
                 wrBuf->space - headerLen,                   /* max out */
                 pIn, contentLen,                            /* input   */
-                type, cwSpec->version, cwSpec->write_seq_num);
+                pseudoHeader, pseudoHeaderLen);
         if (rv != SECSuccess) {
             PORT_SetError(SSL_ERROR_ENCRYPTION_FAILURE);
             return SECFailure;
         }
     } else {
         /*
          * Add the MAC
          */
-        rv = ssl3_ComputeRecordMAC( cwSpec, isServer, isDTLS,
-            type, cwSpec->version, cwSpec->write_seq_num, pIn, contentLen,
+        rv = ssl3_ComputeRecordMAC(cwSpec, isServer,
+            pseudoHeader, pseudoHeaderLen, pIn, contentLen,
             wrBuf->buf + headerLen + ivLen + contentLen, &macLen);
         if (rv != SECSuccess) {
             ssl_MapLowLevelError(SSL_ERROR_MAC_COMPUTATION_FAILURE);
             return SECFailure;
         }
         p1Len   = contentLen;
         p2Len   = macLen;
         fragLen = contentLen + macLen;  /* needs to be encrypted */
         PORT_Assert(fragLen <= MAX_FRAGMENT_LENGTH + 1024);
 
@@ skipping 8684 matching lines @@
     SSL3Opaque           hash[MAX_MAC_LENGTH];
     SSL3Opaque           givenHashBuf[MAX_MAC_LENGTH];
     SSL3Opaque          *givenHash;
     sslBuffer           *plaintext;
     sslBuffer            temp_buf;
     PRUint64             dtls_seq_num;
     unsigned int         ivLen = 0;
     unsigned int         originalLen = 0;
     unsigned int         good;
     unsigned int         minLength;
+    unsigned char        header[13];
+    unsigned int         headerLen;
 
     PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
 
     if (!ss->ssl3.initialized) {
         ssl_GetSSL3HandshakeLock(ss);
         rv = ssl3_InitState(ss);
         ssl_ReleaseSSL3HandshakeLock(ss);
         if (rv != SECSuccess) {
             return rv;          /* ssl3_InitState has set the error code. */
         }
@@ skipping 133 matching lines @@
 
     if (isTLS && cText->buf->len - ivLen > (MAX_FRAGMENT_LENGTH + 2048)) {
         ssl_ReleaseSpecReadLock(ss);
         SSL3_SendAlert(ss, alert_fatal, record_overflow);
         PORT_SetError(SSL_ERROR_RX_RECORD_TOO_LONG);
         return SECFailure;
     }
 
     rType = cText->type;
     if (cipher_def->type == type_aead) {
+        /* XXX Is this true for all AEAD ciphers? */

[Ryan Sleevi, 2013/08/17 02:00:23]

No.

This is covered in http://tools.ietf.org/html/rfc5116#section-4 pp12

   Each AEAD algorithm MUST provide a description relating the length of
   the plaintext to that of the ciphertext.  This relation MUST NOT
   depend on external parameters, such as an authentication strength
   parameter (e.g., authentication tag length).  That sort of dependence
   would complicate the use of the algorithm by creating a situation in
   which the information from the AEAD registry was not sufficient to
   ensure interoperability.


So the existing ciphers:
http://tools.ietf.org/html/rfc5116#section-5.1
   An AEAD_AES_128_GCM ciphertext is exactly 16 octets longer than its
   corresponding plaintext.

http://tools.ietf.org/html/rfc5116#section-5.2
   This algorithm is identical to AEAD_AES_128_GCM, but with the
   following differences:

http://tools.ietf.org/html/rfc5116#section-5.3
   An AEAD_AES_128_CCM ciphertext is exactly 16 octets longer than its
   corresponding plaintext.

http://tools.ietf.org/html/rfc5116#section-5.4
   This algorithm is identical to AEAD_AES_128_CCM, but with the
   following differences:


Also considering the proposed
http://tools.ietf.org/html/draft-mcgrew-aead-aes-cbc-hmac-sha2-02

see
http://tools.ietf.org/html/draft-mcgrew-aead-aes-cbc-hmac-sha2-02#section-2.3

Note that because CBC is used, there is padding.

[wtc, 2013/08/19 23:31:56]

Done. Thank you for the research. I updated the comment.

+        unsigned int decryptedLen =
+            cText->buf->len - cipher_def->explicit_nonce_size -
+            cipher_def->tag_size;
+        headerLen = ssl3_BuildRecordPseudoHeader(header,
+            IS_DTLS(ss) ? cText->seq_num : crSpec->read_seq_num, rType,
+            isTLS, cText->version, IS_DTLS(ss), decryptedLen);
+        PORT_Assert(headerLen <= sizeof(header));
         rv = crSpec->aead(
                 ss->sec.isServer ? &crSpec->client : &crSpec->server,
                 PR_TRUE,                          /* do decrypt */
                 plaintext->buf,                   /* out */
                 (int*) &plaintext->len,           /* outlen */
                 plaintext->space,                 /* maxout */
                 cText->buf->buf,                  /* in */
                 cText->buf->len,                  /* inlen */
-                rType,                            /* record type */
-                cText->version,
-                IS_DTLS(ss) ? cText->seq_num : crSpec->read_seq_num);
+                header, headerLen);
         if (rv != SECSuccess) {
             good = 0;
         }
     } else {
         if (cipher_def->type == type_block &&
             ((cText->buf->len - ivLen) % cipher_def->block_size) != 0) {
             goto decrypt_loser;
         }
 
         /* decrypt from cText buf to plaintext. */
         rv = crSpec->decode(
             crSpec->decodeContext, plaintext->buf, (int *)&plaintext->len,
             plaintext->space, cText->buf->buf + ivLen, cText->buf->len - ivLen);
         if (rv != SECSuccess) {
             goto decrypt_loser;
         }
 
         PRINT_BUF(80, (ss, "cleartext:", plaintext->buf, plaintext->len));
 
         originalLen = plaintext->len;
 
         /* If it's a block cipher, check and strip the padding. */
         if (cipher_def->type == type_block) {
             const unsigned int blockSize = cipher_def->block_size;
             const unsigned int macSize = crSpec->mac_size;
 
-            if (crSpec->version <= SSL_LIBRARY_VERSION_3_0) {
+            if (!isTLS) {
                 good &= SECStatusToMask(ssl_RemoveSSLv3CBCPadding(
                             plaintext, blockSize, macSize));
             } else {
                 good &= SECStatusToMask(ssl_RemoveTLSCBCPadding(
                             plaintext, macSize));
             }
         }
 
         /* compute the MAC */
+        headerLen = ssl3_BuildRecordPseudoHeader(header,
+            IS_DTLS(ss) ? cText->seq_num : crSpec->read_seq_num, rType,
+            isTLS, cText->version, IS_DTLS(ss),
+            plaintext->len - crSpec->mac_size);
+        PORT_Assert(headerLen <= sizeof(header));
         if (cipher_def->type == type_block) {
             rv = ssl3_ComputeRecordMACConstantTime(
-                crSpec, (PRBool)(!ss->sec.isServer),
-                IS_DTLS(ss), rType, cText->version,
-                IS_DTLS(ss) ? cText->seq_num : crSpec->read_seq_num,
+                crSpec, (PRBool)(!ss->sec.isServer), header, headerLen,
                 plaintext->buf, plaintext->len, originalLen,
                 hash, &hashBytes);
 
             ssl_CBCExtractMAC(plaintext, originalLen, givenHashBuf,
                               crSpec->mac_size);
             givenHash = givenHashBuf;
 
             /* plaintext->len will always have enough space to remove the MAC
              * because in ssl_Remove{SSLv3|TLS}CBCPadding we only adjust
              * plaintext->len if the result has enough space for the MAC and we
              * tested the unadjusted size against minLength, above. */
             plaintext->len -= crSpec->mac_size;
         } else {
             /* This is safe because we checked the minLength above. */
             plaintext->len -= crSpec->mac_size;
 
             rv = ssl3_ComputeRecordMAC(
-                crSpec, (PRBool)(!ss->sec.isServer),
-                IS_DTLS(ss), rType, cText->version,
-                IS_DTLS(ss) ? cText->seq_num : crSpec->read_seq_num,
-                plaintext->buf, plaintext->len,
-                hash, &hashBytes);
+                crSpec, (PRBool)(!ss->sec.isServer), header, headerLen,
+                plaintext->buf, plaintext->len, hash, &hashBytes);
 
             /* We can read the MAC directly from the record because its location
              * is public when a stream cipher is used. */
             givenHash = plaintext->buf + plaintext->len;
         }
 
         good &= SECStatusToMask(rv);
 
         if (hashBytes != (unsigned)crSpec->mac_size ||
             NSS_SecureMemcmp(givenHash, hash, crSpec->mac_size) != 0) {
@@ skipping 654 matching lines @@
             PORT_Free(ss->ssl3.hs.recvdFragments.buf);
         }
     }
 
     ss->ssl3.initialized = PR_FALSE;
 
     SECITEM_FreeItem(&ss->ssl3.nextProto, PR_FALSE);
 }
 
 /* End of ssl3con.c */