Branch data     Line data    Source code

       1                 :            : /*
       2                 :            :  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
       3                 :            :  *
       4                 :            :  * Licensed under the Apache License, Version 2.0 (the "License").
       5                 :            :  * You may not use this file except in compliance with the License.
       6                 :            :  * A copy of the License is located at
       7                 :            :  *
       8                 :            :  *  http://aws.amazon.com/apache2.0
       9                 :            :  *
      10                 :            :  * or in the "license" file accompanying this file. This file is distributed
      11                 :            :  * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
      12                 :            :  * express or implied. See the License for the specific language governing
      13                 :            :  * permissions and limitations under the License.
      14                 :            :  */
      15                 :            : 
      16                 :            : #include "error/s2n_errno.h"
      17                 :            : #include "tls/s2n_connection.h"
      18                 :            : #include "tls/s2n_record.h"
      19                 :            : #include "utils/s2n_mem.h"
      20                 :            : #include "utils/s2n_safety.h"
      21                 :            : 
      22                 :            : /* Derive the AAD for an AEAD mode cipher suite from the connection state, per
      23                 :            :  * RFC 5246 section 6.2.3.3 */
      24                 :            : S2N_RESULT s2n_aead_aad_init(const struct s2n_connection *conn, uint8_t *sequence_number, uint8_t content_type, uint16_t record_length, struct s2n_blob *ad)
      25                 :    6553310 : {
      26 [ -  + ][ #  # ]:    6553310 :     RESULT_ENSURE_REF(ad);
      27 [ -  + ][ #  # ]:    6553310 :     RESULT_ENSURE_GTE(ad->size, S2N_TLS_MAX_AAD_LEN);
      28                 :            : 
      29                 :    6553310 :     uint8_t *data = ad->data;
      30         [ -  + ]:    6553310 :     RESULT_GUARD_PTR(data);
      31                 :            : 
      32                 :            :     /* ad = seq_num || record_type || version || length */
      33                 :            : 
      34                 :    6553310 :     size_t idx = 0;
      35         [ +  + ]:   58979790 :     for (; idx < S2N_TLS_SEQUENCE_NUM_LEN; idx++) {
      36                 :   52426480 :         data[idx] = sequence_number[idx];
      37                 :   52426480 :     }
      38                 :            : 
      39                 :    6553310 :     data[idx++] = content_type;
      40                 :    6553310 :     data[idx++] = conn->actual_protocol_version / 10;
      41                 :    6553310 :     data[idx++] = conn->actual_protocol_version % 10;
      42                 :    6553310 :     data[idx++] = record_length >> 8;
      43                 :    6553310 :     data[idx++] = record_length & UINT8_MAX;
      44                 :            : 
      45                 :            :     /* Double check no overflow */
      46 [ #  # ][ -  + ]:    6553310 :     RESULT_ENSURE_LTE(idx, ad->size);
      47                 :    6553310 :     return S2N_RESULT_OK;
      48                 :    6553310 : }
      49                 :            : 
      50                 :            : /* Prepares an AAD (additional authentication data) for a TLS 1.3 AEAD record.
      51                 :            :  *
      52                 :            :  * While the outer wire content type and outer wire version are "hard-coded", it
      53                 :            :  * is still necessary to check that they 
      54                 :            :  * - match the expected values
      55                 :            :  * - are correctly included in the AAD
      56                 :            :  * 
      57                 :            :  * This is necessary to ensure the integrity of the record.
      58                 :            :  */
      59                 :            : S2N_RESULT s2n_tls13_aead_aad_init(struct s2n_record_header *header, struct s2n_blob *additional_data)
      60                 :     181420 : {
      61 [ #  # ][ -  + ]:     181420 :     RESULT_ENSURE_REF(header);
      62 [ +  + ][ +  - ]:     181420 :     RESULT_ENSURE_REF(additional_data);
      63 [ #  # ][ -  + ]:     181419 :     RESULT_ENSURE_GTE(additional_data->size, S2N_TLS13_AAD_LEN);
      64                 :            : 
      65                 :     181419 :     uint8_t *data = additional_data->data;
      66         [ -  + ]:     181419 :     RESULT_GUARD_PTR(data);
      67                 :            : 
      68                 :     181419 :     size_t idx = 0;
      69                 :            : 
      70                 :            :     /**
      71                 :            :      *= https://www.rfc-editor.org/rfc/rfc8446#section-5.2
      72                 :            :      *# opaque_type:  The outer opaque_type field of a TLSCiphertext record
      73                 :            :      *#    is always set to the value 23 (application_data) for outward
      74                 :            :      *#    compatibility with middleboxes accustomed to parsing previous
      75                 :            :      *#    versions of TLS.  The actual content type of the record is found
      76                 :            :      *#    in TLSInnerPlaintext.type after decryption.
      77                 :            :      **/
      78 [ -  + ][ #  # ]:     181419 :     RESULT_ENSURE(header->content_type == TLS_APPLICATION_DATA, S2N_ERR_BAD_MESSAGE);
      79                 :     181419 :     data[idx++] = header->content_type;
      80                 :            : 
      81                 :            :     /**
      82                 :            :      *= https://www.rfc-editor.org/rfc/rfc8446#section-5.2
      83                 :            :      *# legacy_record_version:  The legacy_record_version field is always
      84                 :            :      *#    0x0303.  TLS 1.3 TLSCiphertexts are not generated until after
      85                 :            :      *#    TLS 1.3 has been negotiated, so there are no historical
      86                 :            :      *#    compatibility concerns where other values might be received.  Note
      87                 :            :      *#    that the handshake protocol, including the ClientHello and
      88                 :            :      *#    ServerHello messages, authenticates the protocol version, so this
      89                 :            :      *#    value is redundant.
      90                 :            :      */
      91 [ #  # ][ -  + ]:     181419 :     RESULT_ENSURE(header->version == 0x0303, S2N_ERR_BAD_MESSAGE);
      92                 :            :     /* data needs to be network order */
      93                 :     181419 :     data[idx++] = header->version >> 8;
      94                 :     181419 :     data[idx++] = header->version & UINT8_MAX;
      95                 :            : 
      96                 :            :     /**
      97                 :            :      *= https://www.rfc-editor.org/rfc/rfc8446#section-5.2
      98                 :            :      *# length:  The length (in bytes) of the following
      99                 :            :      *#    TLSCiphertext.encrypted_record, which is the sum of the lengths of
     100                 :            :      *#    the content and the padding, plus one for the inner content type,
     101                 :            :      *#    plus any expansion added by the AEAD algorithm.  The length
     102                 :            :      *#    MUST NOT exceed 2^14 + 256 bytes.  An endpoint that receives a
     103                 :            :      *#    record that exceeds this length MUST terminate the connection with
     104                 :            :      *#    a "record_overflow" alert.
     105                 :            :      */
     106 [ +  + ][ +  - ]:     181419 :     RESULT_ENSURE(header->length <= S2N_TLS13_MAX_RECORD_PAYLOAD_LENGTH, S2N_ERR_RECORD_LIMIT);
     107                 :     181417 :     data[idx++] = header->length >> 8;
     108                 :     181417 :     data[idx++] = header->length & UINT8_MAX;
     109                 :            : 
     110                 :            :     /* Double check no overflow */
     111 [ -  + ][ #  # ]:     181417 :     RESULT_ENSURE_LTE(idx, additional_data->size);
     112                 :     181417 :     return S2N_RESULT_OK;
     113                 :     181417 : }