generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Make DTLS1 record layer MAC calculation RFC compliant.

Browse Source 
Submitted by: Alex Lam
This commit is contained in:
Andy Polyakov 2007-10-09 19:19:07 +00:00
parent ae1552ee99
commit 4fe55663df
1 changed files with 19 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
ssl/t1_enc.c
View File

@ -829,6 +829,7 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send)
EVP_MD_CTX hmac, *mac_ctx; EVP_MD_CTX hmac, *mac_ctx;
unsigned char buf[5]; unsigned char buf[5];
int stream_mac = (send?(ssl->mac_flags & SSL_MAC_FLAG_WRITE_MAC_STREAM):(ssl->mac_flags&SSL_MAC_FLAG_READ_MAC_STREAM)); int stream_mac = (send?(ssl->mac_flags & SSL_MAC_FLAG_WRITE_MAC_STREAM):(ssl->mac_flags&SSL_MAC_FLAG_READ_MAC_STREAM));
if (send) if (send)
{ {
rec= &(ssl->s3->wrec); rec= &(ssl->s3->wrec);
@ -847,8 +848,8 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send)
md_size=EVP_MD_CTX_size(hash); md_size=EVP_MD_CTX_size(hash);
buf[0]=rec->type; buf[0]=rec->type;
buf[1]=TLS1_VERSION_MAJOR; buf[1]=(unsigned char)(ssl->version>>8);
buf[2]=TLS1_VERSION_MINOR; buf[2]=(unsigned char)(ssl->version);
buf[3]=rec->length>>8; buf[3]=rec->length>>8;
buf[4]=rec->length&0xff; buf[4]=rec->length&0xff;
@ -861,8 +862,20 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send)
{ {
EVP_MD_CTX_copy(&hmac,hash); EVP_MD_CTX_copy(&hmac,hash);
mac_ctx = &hmac; mac_ctx = &hmac;
} }
EVP_DigestSignUpdate(mac_ctx,seq,8);
if (ssl->version == DTLS1_VERSION)
{
unsigned char dtlsseq[8],*p=dtlsseq;
s2n(send?ssl->d1->w_epoch:ssl->d1->r_epoch, p);
memcpy (p,&seq[2],6);
EVP_DigestSignUpdate(mac_ctx,dtlsseq,8);
}
else
EVP_DigestSignUpdate(mac_ctx,seq,8);
EVP_DigestSignUpdate(mac_ctx,buf,5); EVP_DigestSignUpdate(mac_ctx,buf,5);
EVP_DigestSignUpdate(mac_ctx,rec->input,rec->length); EVP_DigestSignUpdate(mac_ctx,rec->input,rec->length);
if (stream_mac) EVP_MD_CTX_copy(&hmac,hash); if (stream_mac) EVP_MD_CTX_copy(&hmac,hash);
@ -879,8 +892,8 @@ printf("rec=");
{unsigned int z; for (z=0; z<rec->length; z++) printf("%02X ",buf[z]); printf("\n"); } {unsigned int z; for (z=0; z<rec->length; z++) printf("%02X ",buf[z]); printf("\n"); }
#endif #endif
if ( SSL_version(ssl) != DTLS1_VERSION) if (ssl->version != DTLS1_VERSION)
{ {
for (i=7; i>=0; i--) for (i=7; i>=0; i--)
{ {
++seq[i]; ++seq[i];