Make the AES-GCM cipher suites work in DTLS, by moving the

net/third_party/nss/ssl/ssl3con.c

 /* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
 /*
  * SSL3 Protocol
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /* TODO(ekr): Implement HelloVerifyRequest on server side. OK for now. */
 
@@ skipping 67 matching lines @@
 static SECStatus ssl3_FlushHandshakeMessages(sslSocket *ss, PRInt32 flags);
 static int       ssl3_OIDToTLSHashAlgorithm(SECOidTag oid);
 
 static SECStatus Null_Cipher(void *ctx, unsigned char *output, int *outputLen,
                              int maxOutputLen, const unsigned char *input,
                              int inputLen);
 #ifndef NO_PKCS11_BYPASS
 static SECStatus ssl3_AESGCMBypass(ssl3KeyMaterial *keys, PRBool doDecrypt,
                                    unsigned char *out, int *outlen, int maxout,
                                    const unsigned char *in, int inlen,
-                                   SSL3ContentType type,
-                                   SSL3ProtocolVersion version,
-                                   SSL3SequenceNumber seq_num);
+                                   const unsigned char *additionalData,
+                                   int additionalDataLen);
 #endif
 
 #define MAX_SEND_BUF_LENGTH 32000 /* watch for 16-bit integer overflow */
 #define MIN_SEND_BUF_LENGTH  4000
 
 /* This list of SSL3 cipher suites is sorted in descending order of
  * precedence (desirability).  It only includes cipher suites we implement.
  * This table is modified by SSL3_SetPolicy(). The ordering of cipher suites
  * in this table must match the ordering in SSL_ImplementedCiphers (sslenum.c)
  */
@@ skipping 288 matching lines @@
      cipher_camellia_256, mac_sha, kea_dhe_rsa},
 
     {TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA,
                                     cipher_des,    mac_sha,kea_rsa_export_1024},
     {TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,
                                     cipher_rc4_56, mac_sha,kea_rsa_export_1024},
 
     {SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, kea_rsa_fips},
     {SSL_RSA_FIPS_WITH_DES_CBC_SHA, cipher_des,    mac_sha, kea_rsa_fips},
 
-    {TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_null, kea_dhe_rsa},
-    {TLS_RSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_null, kea_rsa},
-    {TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_null, kea_ecdhe_rsa},
-    {TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_null, kea_ecdhe_ecdsa},
+    {TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_aead, kea_dhe_rsa},
+    {TLS_RSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_aead, kea_rsa},
+    {TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_aead, kea_ecdhe_rsa},
+    {TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, cipher_aes_128_gcm, mac_aead, kea_ecdhe_ecdsa},
 
 #ifdef NSS_ENABLE_ECC
     {TLS_ECDH_ECDSA_WITH_NULL_SHA,        cipher_null, mac_sha, kea_ecdh_ecdsa},
     {TLS_ECDH_ECDSA_WITH_RC4_128_SHA,      cipher_rc4, mac_sha, kea_ecdh_ecdsa},
     {TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, kea_ecdh_ecdsa},
     {TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_ecdh_ecdsa},
     {TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_ecdh_ecdsa},
 
     {TLS_ECDHE_ECDSA_WITH_NULL_SHA,        cipher_null, mac_sha, kea_ecdhe_ecdsa},
     {TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,      cipher_rc4, mac_sha, kea_ecdhe_ecdsa},
@@ skipping 48 matching lines @@
     { calg_3des     , CKM_DES3_CBC                      },
     { calg_idea     , CKM_IDEA_CBC                      },
     { calg_fortezza , CKM_SKIPJACK_CBC64                },
     { calg_aes      , CKM_AES_CBC                       },
     { calg_camellia , CKM_CAMELLIA_CBC                  },
     { calg_seed     , CKM_SEED_CBC                      },
     { calg_aes_gcm  , CKM_AES_GCM                       },
 /*  { calg_init     , (CK_MECHANISM_TYPE)0x7fffffffL    }  */
 };
 
-#define mmech_null     (CK_MECHANISM_TYPE)0x80000000L
+#define mmech_invalid  (CK_MECHANISM_TYPE)0x80000000L
 #define mmech_md5      CKM_SSL3_MD5_MAC
 #define mmech_sha      CKM_SSL3_SHA1_MAC
 #define mmech_md5_hmac CKM_MD5_HMAC
 #define mmech_sha_hmac CKM_SHA_1_HMAC
 #define mmech_sha256_hmac CKM_SHA256_HMAC
+#define mmech_sha384_hmac CKM_SHA384_HMAC
+#define mmech_sha512_hmac CKM_SHA512_HMAC
 
 static const ssl3MACDef mac_defs[] = { /* indexed by SSL3MACAlgorithm */
     /* pad_size is only used for SSL 3.0 MAC. See RFC 6101 Sec. 5.2.3.1. */
     /* mac      mmech       pad_size  mac_size                       */
-    { mac_null, mmech_null,       0,  0          },
+    { mac_null, mmech_invalid,    0,  0          },
     { mac_md5,  mmech_md5,       48,  MD5_LENGTH },
     { mac_sha,  mmech_sha,       40,  SHA1_LENGTH},
     {hmac_md5,  mmech_md5_hmac,   0,  MD5_LENGTH },
     {hmac_sha,  mmech_sha_hmac,   0,  SHA1_LENGTH},
     {hmac_sha256, mmech_sha256_hmac, 0, SHA256_LENGTH},
+    { mac_aead, mmech_invalid,    0,  0          },
 };
 
 /* indexed by SSL3BulkCipher */
 const char * const ssl3_cipherName[] = {
     "NULL",
     "RC4",
     "RC4-40",
     "RC4-56",
     "RC2-CBC",
     "RC2-CBC-40",
@@ skipping 1262 matching lines @@
         case CKM_RC2_MAC:
         case CKM_RC2_MAC_GENERAL:
         case CKM_RC2_CBC_PAD:
             *(CK_RC2_PARAMS *)param->data = ulEffectiveBits;
         default: break;
         }
     }
     return param;
 }
 
-/* ssl3_BuildRecordPseudoHeader writes the TLS pseudo-header (the data which
- * is included in the MAC) to |out| and returns its length. */
+/* ssl3_BuildRecordPseudoHeader writes the SSL/TLS pseudo-header (the data
+ * which is included in the MAC or AEAD additional data) to |out| and returns
+ * its length. See https://tools.ietf.org/html/rfc5246#section-6.2.3.3 for the
+ * definition of the AEAD additional data.
+ *
+ * TLS pseudo-header includes the record's version field, SSL's doesn't. Which
+ * pseudo-header defintiion to use should be decided based on the version of
+ * the protocol that was negotiated when the cipher spec became current, NOT
+ * based on the version value in the record itself, and the decision is passed
+ * to this function as the |includesVersion| argument. But, the |version|
+ * argument should be the record's version value.
+ */
 static unsigned int
 ssl3_BuildRecordPseudoHeader(unsigned char *out,
                              SSL3SequenceNumber seq_num,
                              SSL3ContentType type,
                              PRBool includesVersion,
                              SSL3ProtocolVersion version,
                              PRBool isDTLS,
                              int length)
 {
     out[0] = (unsigned char)(seq_num.high >> 24);
@@ skipping 93 matching lines @@
 }
 
 static SECStatus
 ssl3_AESGCM(ssl3KeyMaterial *keys,
             PRBool doDecrypt,
             unsigned char *out,
             int *outlen,
             int maxout,
             const unsigned char *in,
             int inlen,
-            SSL3ContentType type,
-            SSL3ProtocolVersion version,
-            SSL3SequenceNumber seq_num)
+            const unsigned char *additionalData,
+            int additionalDataLen)
 {
     SECItem            param;
     SECStatus          rv = SECFailure;
     unsigned char      nonce[12];
-    unsigned char      additionalData[13];
-    unsigned int       additionalDataLen;
     unsigned int       uOutLen;
     CK_GCM_PARAMS      gcmParams;
 
     static const int   tagSize = 16;
     static const int   explicitNonceLen = 8;
 
-    /* See https://tools.ietf.org/html/rfc5246#section-6.2.3.3 for the
-     * definition of the AEAD additional data. */
-    additionalDataLen = ssl3_BuildRecordPseudoHeader(
-        additionalData, seq_num, type, PR_TRUE /* includes version */,
-        version, PR_FALSE /* not DTLS */,
-        inlen - (doDecrypt ? explicitNonceLen + tagSize : 0));
-    PORT_Assert(additionalDataLen <= sizeof(additionalData));
-
     /* See https://tools.ietf.org/html/rfc5288#section-3 for details of how the
      * nonce is formed. */
     memcpy(nonce, keys->write_iv, 4);
     if (doDecrypt) {
         memcpy(nonce + 4, in, explicitNonceLen);
         in += explicitNonceLen;
         inlen -= explicitNonceLen;
         *outlen = 0;
     } else {
         if (maxout < explicitNonceLen) {
             PORT_SetError(SEC_ERROR_INPUT_LEN);
             return SECFailure;
         }
         /* Use the 64-bit sequence number as the explicit nonce. */
         memcpy(nonce + 4, additionalData, explicitNonceLen);
         memcpy(out, additionalData, explicitNonceLen);
         out += explicitNonceLen;
         maxout -= explicitNonceLen;
         *outlen = explicitNonceLen;
     }
 
     param.type = siBuffer;
     param.data = (unsigned char *) &gcmParams;
     param.len = sizeof(gcmParams);
     gcmParams.pIv = nonce;
     gcmParams.ulIvLen = sizeof(nonce);
-    gcmParams.pAAD = additionalData;
+    gcmParams.pAAD = (unsigned char *)additionalData;  /* const cast */
     gcmParams.ulAADLen = additionalDataLen;
     gcmParams.ulTagBits = tagSize * 8;
 
     if (doDecrypt) {
         rv = pk11_decrypt(keys->write_key, CKM_AES_GCM, &param, out, &uOutLen,
                           maxout, in, inlen);
     } else {
         rv = pk11_encrypt(keys->write_key, CKM_AES_GCM, &param, out, &uOutLen,
                           maxout, in, inlen);
     }
     *outlen += (int) uOutLen;
 
     return rv;
 }
 
 #ifndef NO_PKCS11_BYPASS
 static SECStatus
 ssl3_AESGCMBypass(ssl3KeyMaterial *keys,
                   PRBool doDecrypt,
                   unsigned char *out,
                   int *outlen,
                   int maxout,
                   const unsigned char *in,
                   int inlen,
-                  SSL3ContentType type,
-                  SSL3ProtocolVersion version,
-                  SSL3SequenceNumber seq_num)
+                  const unsigned char *additionalData,
+                  int additionalDataLen)
 {
     SECStatus          rv = SECFailure;
     unsigned char      nonce[12];
-    unsigned char      additionalData[13];
-    unsigned int       additionalDataLen;
     unsigned int       uOutLen;
     AESContext        *cx;
     CK_GCM_PARAMS      gcmParams;
 
     static const int   tagSize = 16;
     static const int   explicitNonceLen = 8;
 
-    /* See https://tools.ietf.org/html/rfc5246#section-6.2.3.3 for the
-     * definition of the AEAD additional data. */
-    additionalDataLen = ssl3_BuildRecordPseudoHeader(
-        additionalData, seq_num, type, PR_TRUE /* includes version */,
-        version, PR_FALSE /* not DTLS */,
-        inlen - (doDecrypt ? explicitNonceLen + tagSize : 0));
-    PORT_Assert(additionalDataLen <= sizeof(additionalData));
-
     /* See https://tools.ietf.org/html/rfc5288#section-3 for details of how the
      * nonce is formed. */
     PORT_Assert(keys->write_iv_item.len == 4);
     if (keys->write_iv_item.len != 4) {
         PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
         return SECFailure;
     }
     memcpy(nonce, keys->write_iv_item.data, 4);
     if (doDecrypt) {
         memcpy(nonce + 4, in, explicitNonceLen);
         in += explicitNonceLen;
         inlen -= explicitNonceLen;
         *outlen = 0;
     } else {
         if (maxout < explicitNonceLen) {
             PORT_SetError(SEC_ERROR_INPUT_LEN);
             return SECFailure;
         }
         /* Use the 64-bit sequence number as the explicit nonce. */
         memcpy(nonce + 4, additionalData, explicitNonceLen);
         memcpy(out, additionalData, explicitNonceLen);
         out += explicitNonceLen;
         maxout -= explicitNonceLen;
         *outlen = explicitNonceLen;
     }
 
     gcmParams.pIv = nonce;
     gcmParams.ulIvLen = sizeof(nonce);
-    gcmParams.pAAD = additionalData;
+    gcmParams.pAAD = (unsigned char *)additionalData;  /* const cast */
     gcmParams.ulAADLen = additionalDataLen;
     gcmParams.ulTagBits = tagSize * 8;
 
     cx = (AESContext *)keys->cipher_context;
     rv = AES_InitContext(cx, keys->write_key_item.data,
                          keys->write_key_item.len,
                          (unsigned char *)&gcmParams, NSS_AES_GCM, !doDecrypt,
                          AES_BLOCK_SIZE);
     if (rv != SECSuccess) {
         return rv;
@@ skipping 280 matching lines @@
     0x5c, 0x5c, 0x5c, 0x5c
 };
 
 /* Called from: ssl3_SendRecord()
 ** Caller must already hold the SpecReadLock. (wish we could assert that!)
 */
 static SECStatus
 ssl3_ComputeRecordMAC(
     ssl3CipherSpec *   spec,
     PRBool             useServerMacKey,
-    PRBool             isDTLS,
-    SSL3ContentType    type,
-    SSL3ProtocolVersion version,
-    SSL3SequenceNumber seq_num,
+    const unsigned char *header,
+    unsigned int       headerLen,
     const SSL3Opaque * input,
     int                inputLength,
     unsigned char *    outbuf,
     unsigned int *     outLength)
 {
     const ssl3MACDef * mac_def;
     SECStatus          rv;
-    PRBool             isTLS;
-    unsigned int       tempLen;
-    unsigned char      temp[MAX_MAC_LENGTH];
 
-    /* TLS MAC includes the record's version field, SSL's doesn't.
-    ** We decide which MAC defintiion to use based on the version of 
-    ** the protocol that was negotiated when the spec became current,
-    ** NOT based on the version value in the record itself.
-    ** But, we use the record's version value in the computation.
-    */
-    isTLS = spec->version > SSL_LIBRARY_VERSION_3_0;
-    tempLen = ssl3_BuildRecordPseudoHeader(temp, seq_num, type, isTLS,
-                                           version, isDTLS, inputLength);
-    PORT_Assert(tempLen <= sizeof(temp));
-
-    PRINT_BUF(95, (NULL, "frag hash1: temp", temp, tempLen));
+    PRINT_BUF(95, (NULL, "frag hash1: header", header, headerLen));
     PRINT_BUF(95, (NULL, "frag hash1: input", input, inputLength));
 
     mac_def = spec->mac_def;
     if (mac_def->mac == mac_null) {
         *outLength = 0;
         return SECSuccess;
     }
 #ifndef NO_PKCS11_BYPASS
     if (spec->bypassCiphers) {
         /* bypass version */
@@ skipping 24 matching lines @@
             break;
         default:
             break;
         }
         if (!hashObj) {
             PORT_Assert(0);
             PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
             return SECFailure;
         }
 
-        if (!isTLS) {
+        if (spec->version <= SSL_LIBRARY_VERSION_3_0) {
+            unsigned int tempLen;
+            unsigned char temp[MAX_MAC_LENGTH];
+
             /* compute "inner" part of SSL3 MAC */
             hashObj->begin(write_mac_context);
             if (useServerMacKey)
                 hashObj->update(write_mac_context, 
                                 spec->server.write_mac_key_item.data,
                                 spec->server.write_mac_key_item.len);
             else
                 hashObj->update(write_mac_context, 
                                 spec->client.write_mac_key_item.data,
                                 spec->client.write_mac_key_item.len);
             hashObj->update(write_mac_context, mac_pad_1, pad_bytes);
-            hashObj->update(write_mac_context, temp,  tempLen);
+            hashObj->update(write_mac_context, header, headerLen);
             hashObj->update(write_mac_context, input, inputLength);
             hashObj->end(write_mac_context,    temp, &tempLen, sizeof temp);
 
             /* compute "outer" part of SSL3 MAC */
             hashObj->begin(write_mac_context);
             if (useServerMacKey)
                 hashObj->update(write_mac_context, 
                                 spec->server.write_mac_key_item.data,
                                 spec->server.write_mac_key_item.len);
             else
@@ skipping 10 matching lines @@
                 rv = HMAC_Init(cx, hashObj, 
                                spec->server.write_mac_key_item.data,
                                spec->server.write_mac_key_item.len, PR_FALSE);
             } else {
                 rv = HMAC_Init(cx, hashObj, 
                                spec->client.write_mac_key_item.data,
                                spec->client.write_mac_key_item.len, PR_FALSE);
             }
             if (rv == SECSuccess) {
                 HMAC_Begin(cx);
-                HMAC_Update(cx, temp, tempLen);
+                HMAC_Update(cx, header, headerLen);
                 HMAC_Update(cx, input, inputLength);
                 rv = HMAC_Finish(cx, outbuf, outLength, spec->mac_size);
                 HMAC_Destroy(cx, PR_FALSE);
             }
 #undef cx
         }
     } else
 #endif
     {
         PK11Context *mac_context = 
             (useServerMacKey ? spec->server.write_mac_context
                              : spec->client.write_mac_context);
         rv  = PK11_DigestBegin(mac_context);
-        rv |= PK11_DigestOp(mac_context, temp, tempLen);
+        rv |= PK11_DigestOp(mac_context, header, headerLen);
         rv |= PK11_DigestOp(mac_context, input, inputLength);
         rv |= PK11_DigestFinal(mac_context, outbuf, outLength, spec->mac_size);
     }
 
     PORT_Assert(rv != SECSuccess || *outLength == (unsigned)spec->mac_size);
 
     PRINT_BUF(95, (NULL, "frag hash2: result", outbuf, *outLength));
 
     if (rv != SECSuccess) {
         rv = SECFailure;
@@ skipping 19 matching lines @@
 /* Called from: ssl3_HandleRecord()
  * Caller must already hold the SpecReadLock. (wish we could assert that!)
  *
  * On entry:
  *   originalLen >= inputLen >= MAC size
 */
 static SECStatus
 ssl3_ComputeRecordMACConstantTime(
     ssl3CipherSpec *   spec,
     PRBool             useServerMacKey,
-    PRBool             isDTLS,
-    SSL3ContentType    type,
-    SSL3ProtocolVersion version,
-    SSL3SequenceNumber seq_num,
+    const unsigned char *header,
+    unsigned int       headerLen,
     const SSL3Opaque * input,
     int                inputLen,
     int                originalLen,
     unsigned char *    outbuf,
     unsigned int *     outLen)
 {
     CK_MECHANISM_TYPE            macType;
     CK_NSS_MAC_CONSTANT_TIME_PARAMS params;
     PK11Context *                mac_context;
     SECItem                      param;
     SECStatus                    rv;
-    unsigned char                header[13];
     PK11SymKey *                 key;
-    int                          recordLength;
 
     PORT_Assert(inputLen >= spec->mac_size);
     PORT_Assert(originalLen >= inputLen);
 
     if (spec->bypassCiphers) {
         /* This function doesn't support PKCS#11 bypass. We fallback on the
          * non-constant time version. */
         goto fallback;
     }
 
     if (spec->mac_def->mac == mac_null) {
         *outLen = 0;
         return SECSuccess;
     }
 
-    header[0] = (unsigned char)(seq_num.high >> 24);
-    header[1] = (unsigned char)(seq_num.high >> 16);
-    header[2] = (unsigned char)(seq_num.high >>  8);
-    header[3] = (unsigned char)(seq_num.high >>  0);
-    header[4] = (unsigned char)(seq_num.low  >> 24);
-    header[5] = (unsigned char)(seq_num.low  >> 16);
-    header[6] = (unsigned char)(seq_num.low  >>  8);
-    header[7] = (unsigned char)(seq_num.low  >>  0);
-    header[8] = type;
-
     macType = CKM_NSS_HMAC_CONSTANT_TIME;
-    recordLength = inputLen - spec->mac_size;
     if (spec->version <= SSL_LIBRARY_VERSION_3_0) {
         macType = CKM_NSS_SSL3_MAC_CONSTANT_TIME;
-        header[9] = recordLength >> 8;
-        header[10] = recordLength;
-        params.ulHeaderLen = 11;
-    } else {
-        if (isDTLS) {
-            SSL3ProtocolVersion dtls_version;
-
-            dtls_version = dtls_TLSVersionToDTLSVersion(version);
-            header[9] = dtls_version >> 8;
-            header[10] = dtls_version;
-        } else {
-            header[9] = version >> 8;
-            header[10] = version;
-        }
-        header[11] = recordLength >> 8;
-        header[12] = recordLength;
-        params.ulHeaderLen = 13;
     }
 
     params.macAlg = spec->mac_def->mmech;
     params.ulBodyTotalLen = originalLen;
-    params.pHeader = header;
+    params.pHeader = (unsigned char *) header;  /* const cast */
+    params.ulHeaderLen = headerLen;
 
     param.data = (unsigned char*) &params;
     param.len = sizeof(params);
     param.type = 0;
 
     key = spec->server.write_mac_key;
     if (!useServerMacKey) {
         key = spec->client.write_mac_key;
     }
     mac_context = PK11_CreateContextBySymKey(macType, CKA_SIGN, key, &param);
@@ skipping 12 matching lines @@
     if (rv != SECSuccess) {
         rv = SECFailure;
         ssl_MapLowLevelError(SSL_ERROR_MAC_COMPUTATION_FAILURE);
     }
     return rv;
 
 fallback:
     /* ssl3_ComputeRecordMAC expects the MAC to have been removed from the
      * length already. */
     inputLen -= spec->mac_size;
-    return ssl3_ComputeRecordMAC(spec, useServerMacKey, isDTLS, type,
-                                 version, seq_num, input, inputLen,
-                                 outbuf, outLen);
+    return ssl3_ComputeRecordMAC(spec, useServerMacKey, header, headerLen,
+                                 input, inputLen, outbuf, outLen);
 }
 
 static PRBool
 ssl3_ClientAuthTokenPresent(sslSessionID *sid) {
     PK11SlotInfo *slot = NULL;
     PRBool isPresent = PR_TRUE;
 
     /* we only care if we are doing client auth */
     /* If NSS_PLATFORM_CLIENT_AUTH is defined and a platformClientKey is being
      * used, u.ssl3.clAuthValid will be false and this function will always
@@ skipping 31 matching lines @@
                               sslBuffer *        wrBuf)
 {
     const ssl3BulkCipherDef * cipher_def;
     SECStatus                 rv;
     PRUint32                  macLen = 0;
     PRUint32                  fragLen;
     PRUint32  p1Len, p2Len, oddLen = 0;
     PRUint16                  headerLen;
     int                       ivLen = 0;
     int                       cipherBytes = 0;
+    unsigned char             pseudoHeader[13];
+    unsigned int              pseudoHeaderLen;
 
     cipher_def = cwSpec->cipher_def;
     headerLen = isDTLS ? DTLS_RECORD_HEADER_LENGTH : SSL3_RECORD_HEADER_LENGTH;
 
     if (cipher_def->type == type_block &&
         cwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_1) {
         /* Prepend the per-record explicit IV using technique 2b from
          * RFC 4346 section 6.2.3.2: The IV is a cryptographically
          * strong random number XORed with the CBC residue from the previous
          * record.
@@ skipping 25 matching lines @@
         rv = cwSpec->compressor(
             cwSpec->compressContext,
             wrBuf->buf + headerLen + ivLen, &outlen,
             wrBuf->space - headerLen - ivLen, pIn, contentLen);
         if (rv != SECSuccess)
             return rv;
         pIn = wrBuf->buf + headerLen + ivLen;
         contentLen = outlen;
     }
 
+    pseudoHeaderLen = ssl3_BuildRecordPseudoHeader(
+        pseudoHeader, cwSpec->write_seq_num, type,
+        cwSpec->version >= SSL_LIBRARY_VERSION_TLS_1_0, cwSpec->version,
+        isDTLS, contentLen);
+    PORT_Assert(pseudoHeaderLen <= sizeof(pseudoHeader));
     if (cipher_def->type == type_aead) {
         const int nonceLen = cipher_def->explicit_nonce_size;
         const int tagLen = cipher_def->tag_size;
 
         if (headerLen + nonceLen + contentLen + tagLen > wrBuf->space) {
             PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
             return SECFailure;
         }
 
         cipherBytes = contentLen;
         rv = cwSpec->aead(
                 isServer ? &cwSpec->server : &cwSpec->client,
                 PR_FALSE,                                   /* do encrypt */
                 wrBuf->buf + headerLen,                     /* output  */
                 &cipherBytes,                               /* out len */
                 wrBuf->space - headerLen,                   /* max out */
                 pIn, contentLen,                            /* input   */
-                type, cwSpec->version, cwSpec->write_seq_num);
+                pseudoHeader, pseudoHeaderLen);
         if (rv != SECSuccess) {
             PORT_SetError(SSL_ERROR_ENCRYPTION_FAILURE);
             return SECFailure;
         }
     } else {
         /*
          * Add the MAC
          */
-        rv = ssl3_ComputeRecordMAC( cwSpec, isServer, isDTLS,
-            type, cwSpec->version, cwSpec->write_seq_num, pIn, contentLen,
+        rv = ssl3_ComputeRecordMAC(cwSpec, isServer,
+            pseudoHeader, pseudoHeaderLen, pIn, contentLen,
             wrBuf->buf + headerLen + ivLen + contentLen, &macLen);
         if (rv != SECSuccess) {
             ssl_MapLowLevelError(SSL_ERROR_MAC_COMPUTATION_FAILURE);
             return SECFailure;
         }
         p1Len   = contentLen;
         p2Len   = macLen;
         fragLen = contentLen + macLen;  /* needs to be encrypted */
         PORT_Assert(fragLen <= MAX_FRAGMENT_LENGTH + 1024);
 
@@ skipping 8684 matching lines @@
     SSL3Opaque           hash[MAX_MAC_LENGTH];
     SSL3Opaque           givenHashBuf[MAX_MAC_LENGTH];
     SSL3Opaque          *givenHash;
     sslBuffer           *plaintext;
     sslBuffer            temp_buf;
     PRUint64             dtls_seq_num;
     unsigned int         ivLen = 0;
     unsigned int         originalLen = 0;
     unsigned int         good;
     unsigned int         minLength;
+    unsigned char        header[13];
+    unsigned int         headerLen;
 
     PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
 
     if (!ss->ssl3.initialized) {
         ssl_GetSSL3HandshakeLock(ss);
         rv = ssl3_InitState(ss);
         ssl_ReleaseSSL3HandshakeLock(ss);
         if (rv != SECSuccess) {
             return rv;          /* ssl3_InitState has set the error code. */
         }
@@ skipping 133 matching lines @@
 
     if (isTLS && cText->buf->len - ivLen > (MAX_FRAGMENT_LENGTH + 2048)) {
         ssl_ReleaseSpecReadLock(ss);
         SSL3_SendAlert(ss, alert_fatal, record_overflow);
         PORT_SetError(SSL_ERROR_RX_RECORD_TOO_LONG);
         return SECFailure;
     }
 
     rType = cText->type;
     if (cipher_def->type == type_aead) {
+        /* XXX For many AEAD ciphers, the plaintext is shorter than the
+         * ciphertext by a fixed byte count, but it is not true in general.
+         * Each AEAD cipher should provide a function that returns the
+         * plaintext length for a given ciphertext. */
+        unsigned int decryptedLen =
+            cText->buf->len - cipher_def->explicit_nonce_size -
+            cipher_def->tag_size;
+        headerLen = ssl3_BuildRecordPseudoHeader(
+            header, IS_DTLS(ss) ? cText->seq_num : crSpec->read_seq_num,
+            rType, isTLS, cText->version, IS_DTLS(ss), decryptedLen);
+        PORT_Assert(headerLen <= sizeof(header));
         rv = crSpec->aead(
                 ss->sec.isServer ? &crSpec->client : &crSpec->server,
                 PR_TRUE,                          /* do decrypt */
                 plaintext->buf,                   /* out */
                 (int*) &plaintext->len,           /* outlen */
                 plaintext->space,                 /* maxout */
                 cText->buf->buf,                  /* in */
                 cText->buf->len,                  /* inlen */
-                rType,                            /* record type */
-                cText->version,
-                IS_DTLS(ss) ? cText->seq_num : crSpec->read_seq_num);
+                header, headerLen);
         if (rv != SECSuccess) {
             good = 0;
         }
     } else {
         if (cipher_def->type == type_block &&
             ((cText->buf->len - ivLen) % cipher_def->block_size) != 0) {
             goto decrypt_loser;
         }
 
         /* decrypt from cText buf to plaintext. */
         rv = crSpec->decode(
             crSpec->decodeContext, plaintext->buf, (int *)&plaintext->len,
             plaintext->space, cText->buf->buf + ivLen, cText->buf->len - ivLen);
         if (rv != SECSuccess) {
             goto decrypt_loser;
         }
 
         PRINT_BUF(80, (ss, "cleartext:", plaintext->buf, plaintext->len));
 
         originalLen = plaintext->len;
 
         /* If it's a block cipher, check and strip the padding. */
         if (cipher_def->type == type_block) {
             const unsigned int blockSize = cipher_def->block_size;
             const unsigned int macSize = crSpec->mac_size;
 
-            if (crSpec->version <= SSL_LIBRARY_VERSION_3_0) {
+            if (!isTLS) {
                 good &= SECStatusToMask(ssl_RemoveSSLv3CBCPadding(
                             plaintext, blockSize, macSize));
             } else {
                 good &= SECStatusToMask(ssl_RemoveTLSCBCPadding(
                             plaintext, macSize));
             }
         }
 
         /* compute the MAC */
+        headerLen = ssl3_BuildRecordPseudoHeader(
+            header, IS_DTLS(ss) ? cText->seq_num : crSpec->read_seq_num,
+            rType, isTLS, cText->version, IS_DTLS(ss),
+            plaintext->len - crSpec->mac_size);
+        PORT_Assert(headerLen <= sizeof(header));
         if (cipher_def->type == type_block) {
             rv = ssl3_ComputeRecordMACConstantTime(
-                crSpec, (PRBool)(!ss->sec.isServer),
-                IS_DTLS(ss), rType, cText->version,
-                IS_DTLS(ss) ? cText->seq_num : crSpec->read_seq_num,
+                crSpec, (PRBool)(!ss->sec.isServer), header, headerLen,
                 plaintext->buf, plaintext->len, originalLen,
                 hash, &hashBytes);
 
             ssl_CBCExtractMAC(plaintext, originalLen, givenHashBuf,
                               crSpec->mac_size);
             givenHash = givenHashBuf;
 
             /* plaintext->len will always have enough space to remove the MAC
              * because in ssl_Remove{SSLv3|TLS}CBCPadding we only adjust
              * plaintext->len if the result has enough space for the MAC and we
              * tested the unadjusted size against minLength, above. */
             plaintext->len -= crSpec->mac_size;
         } else {
             /* This is safe because we checked the minLength above. */
             plaintext->len -= crSpec->mac_size;
 
             rv = ssl3_ComputeRecordMAC(
-                crSpec, (PRBool)(!ss->sec.isServer),
-                IS_DTLS(ss), rType, cText->version,
-                IS_DTLS(ss) ? cText->seq_num : crSpec->read_seq_num,
-                plaintext->buf, plaintext->len,
-                hash, &hashBytes);
+                crSpec, (PRBool)(!ss->sec.isServer), header, headerLen,
+                plaintext->buf, plaintext->len, hash, &hashBytes);
 
             /* We can read the MAC directly from the record because its location
              * is public when a stream cipher is used. */
             givenHash = plaintext->buf + plaintext->len;
         }
 
         good &= SECStatusToMask(rv);
 
         if (hashBytes != (unsigned)crSpec->mac_size ||
             NSS_SecureMemcmp(givenHash, hash, crSpec->mac_size) != 0) {
@@ skipping 654 matching lines @@
             PORT_Free(ss->ssl3.hs.recvdFragments.buf);
         }
     }
 
     ss->ssl3.initialized = PR_FALSE;
 
     SECITEM_FreeItem(&ss->ssl3.nextProto, PR_FALSE);
 }
 
 /* End of ssl3con.c */