/*

 * Copyright (C) 2000-2013 Free Software Foundation, Inc.

 * Copyright (C) 2013 Nikos Mavrogiannopoulos

 * Copyright (C) 2017-2018 Red Hat, Inc.

 *

 * Author: Nikos Mavrogiannopoulos

 *

 * This file is part of GnuTLS.

 *

 * The GnuTLS is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public License

 * as published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>

 *

 */

#include "gnutls_int.h"

#include "cipher.h"

static void dummy_wait(record_parameters_st *params,

		       const uint8_t *data, size_t data_size,

		       unsigned int mac_data, unsigned int max_mac_data)

{

	/* this hack is only needed on CBC ciphers when Encrypt-then-MAC mode

	 * is not supported by the peer. */

	unsigned v;

	unsigned int tag_size =

	    _gnutls_auth_cipher_tag_len(&params->read.ctx.tls12);

	unsigned hash_block = _gnutls_mac_block_size(params->mac);

	/* force additional hash compression function evaluations to prevent timing

	 * attacks that distinguish between wrong-mac + correct pad, from wrong-mac + incorrect pad.

	 */

	if (params->mac && params->mac->id == GNUTLS_MAC_SHA384)

		/* v = 1 for the hash function padding + 16 for message length */

		v = 17;

	else /* v = 1 for the hash function padding + 8 for message length */

		v = 9;

	if (hash_block > 0) {

		int max_blocks = (max_mac_data+v+hash_block-1)/hash_block;

		int hashed_blocks = (mac_data+v+hash_block-1)/hash_block;

		unsigned to_hash;

		max_blocks -= hashed_blocks;

		if (max_blocks < 1)

			return;

		to_hash = max_blocks * hash_block;

		if ((unsigned)to_hash+1+tag_size < data_size) {

			_gnutls_auth_cipher_add_auth

				    (&params->read.ctx.tls12,

				     data+data_size-tag_size-to_hash-1,

				     to_hash);

		}

	}

}

/* Verifies the CBC HMAC. That's a special case as it tries to avoid

 * any leaks which could make CBC ciphersuites without EtM usable as an

 * oracle to attacks.

 */

int cbc_mac_verify(gnutls_session_t session, record_parameters_st *params,

		   uint8_t preamble[MAX_PREAMBLE_SIZE],

		   content_type_t type,

		   uint64_t sequence,

		   const uint8_t *data, size_t data_size,

		   size_t tag_size)

{

	int ret;

	const version_entry_st *ver = get_version(session);

	unsigned int tmp_pad_failed = 0;

	unsigned int pad_failed = 0;

	unsigned int pad, i, length;

	const uint8_t *tag_ptr = NULL;

	unsigned preamble_size;

	uint8_t tag[MAX_HASH_SIZE];

#ifdef ENABLE_SSL3

	unsigned blocksize = _gnutls_cipher_get_block_size(params->cipher);

#endif

	pad = data[data_size - 1];	/* pad */

	/* Check the padding bytes (TLS 1.x).

	 * Note that we access all 256 bytes of ciphertext for padding check

	 * because there is a timing channel in that memory access (in certain CPUs).

	 */

#ifdef ENABLE_SSL3

	if (ver->id == GNUTLS_SSL3) {

		if (pad >= blocksize)

			pad_failed = 1;

	} else

#endif

	{

		for (i = 2; i <= MIN(256, data_size); i++) {

			tmp_pad_failed |=

			    (data[data_size - i] != pad);

			pad_failed |=

			    ((i <= (1 + pad)) & (tmp_pad_failed));

		}

	}

	if (unlikely

	    (pad_failed != 0

	     || (1 + pad > ((int) data_size - tag_size)))) {

		/* We do not fail here. We check below for the

		 * the pad_failed. If zero means success.

		 */

		pad_failed = 1;

		pad = 0;

	}

	length = data_size - tag_size - pad - 1;

	tag_ptr = &data[length];

	/* Pass the type, version, length and plain through

	 * MAC.

	 */

	preamble_size =

	    _gnutls_make_preamble(sequence, type,

				  length, ver, preamble);

	ret =

	    _gnutls_auth_cipher_add_auth(&params->read.

					 ctx.tls12, preamble,

					 preamble_size);

	if (unlikely(ret < 0))

		return gnutls_assert_val(ret);

	ret =

	    _gnutls_auth_cipher_add_auth(&params->read.

					 ctx.tls12,

					 data, length);

	if (unlikely(ret < 0))

		return gnutls_assert_val(ret);

	ret =

	    _gnutls_auth_cipher_tag(&params->read.ctx.tls12, tag,

				    tag_size);

	if (unlikely(ret < 0))

		return gnutls_assert_val(ret);

	if (unlikely

	    (gnutls_memcmp(tag, tag_ptr, tag_size) != 0 || pad_failed != 0)) {

		/* HMAC was not the same. */

		dummy_wait(params, data, data_size,

			   length + preamble_size,

			   preamble_size + data_size - tag_size - 1);

		return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

	}

	return length;

}