diff options
| author | David Woodhouse <David.Woodhouse@intel.com> | 2016-10-12 23:12:04 +0100 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2016-10-17 23:17:39 +0100 |
| commit | e23d5071ec4c7aa6bb2b0f2c3e0fc2182ed7e63f (patch) | |
| tree | ed8e1464484e0e8d2d196bf1c99a3219865eac22 /ssl/record/rec_layer_d1.c | |
| parent | b2e54eb834e2d5a79d03f12a818d68f82c0e3d13 (diff) | |
| download | openssl-new-e23d5071ec4c7aa6bb2b0f2c3e0fc2182ed7e63f.tar.gz | |
Fix encrypt-then-mac implementation for DTLS
OpenSSL 1.1.0 will negotiate EtM on DTLS but will then not actually *do* it.
If we use DTLSv1.2 that will hopefully be harmless since we'll tend to use
an AEAD ciphersuite anyway. But if we're using DTLSv1, then we certainly
will end up using CBC, so EtM is relevant — and we fail to interoperate with
anything that implements EtM correctly.
Fixing it in HEAD and 1.1.0c will mean that 1.1.0[ab] are incompatible with
1.1.0c+... for the limited case of non-AEAD ciphers, where they're *already*
incompatible with other implementations due to this bug anyway. That seems
reasonable enough, so let's do it. The only alternative is just to turn it
off for ever... which *still* leaves 1.0.0[ab] failing to communicate with
non-OpenSSL implementations anyway.
Tested against itself as well as against GnuTLS both with and without EtM.
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Diffstat (limited to 'ssl/record/rec_layer_d1.c')
| -rw-r--r-- | ssl/record/rec_layer_d1.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/ssl/record/rec_layer_d1.c b/ssl/record/rec_layer_d1.c index 1d16319f14..c9fd0669ed 100644 --- a/ssl/record/rec_layer_d1.c +++ b/ssl/record/rec_layer_d1.c @@ -1094,7 +1094,7 @@ int do_dtls1_write(SSL *s, int type, const unsigned char *buf, * wb->buf */ - if (mac_size != 0) { + if (!SSL_USE_ETM(s) && mac_size != 0) { if (s->method->ssl3_enc->mac(s, &wr, &(p[SSL3_RECORD_get_length(&wr) + eivlen]), 1) < 0) @@ -1112,6 +1112,14 @@ int do_dtls1_write(SSL *s, int type, const unsigned char *buf, if (s->method->ssl3_enc->enc(s, &wr, 1, 1) < 1) goto err; + if (SSL_USE_ETM(s) && mac_size != 0) { + if (s->method->ssl3_enc->mac(s, &wr, + &(p[SSL3_RECORD_get_length(&wr)]), + 1) < 0) + goto err; + SSL3_RECORD_add_length(&wr, mac_size); + } + /* record length after mac and block padding */ /* * if (type == SSL3_RT_APPLICATION_DATA || (type == SSL3_RT_ALERT && ! |