/usr/src/lib/libssl/tls13_record

Bug Summary

File:	src/lib/libssl/tls13_record_layer.c
Warning:	line 595, column 2 Potential leak of memory pointed to by 'content'
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name tls13_record_layer.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/lib/libssl/obj -resource-dir /usr/local/lib/clang/13.0.0 -D LIBRESSL_INTERNAL -I /usr/src/lib/libssl -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/lib/libssl/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/lib/libssl/tls13_record_layer.c
1/* $OpenBSD: tls13_record_layer.c,v 1.66 2022/01/06 18:18:13 jsing Exp $ */
2/*
* Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

18#include "tls13_internal.h"
19#include "tls13_record.h"
20#include "tls_content.h"

22static ssize_t tls13_record_layer_write_chunk(struct tls13_record_layer *rl,
  uint8_t content_type, const uint8_t *buf, size_t n);
24static ssize_t tls13_record_layer_write_record(struct tls13_record_layer *rl,
  uint8_t content_type, const uint8_t *content, size_t content_len);

27struct tls13_record_protection {
EVP_AEAD_CTX *aead_ctx;
struct tls13_secret iv;
struct tls13_secret nonce;
uint8_t seq_num[TLS13_RECORD_SEQ_NUM_LEN8];
32};

34struct tls13_record_protection *
35tls13_record_protection_new(void)
36{
return calloc(1, sizeof(struct tls13_record_protection));
38}

40void
41tls13_record_protection_clear(struct tls13_record_protection *rp)
42{
if (rp->aead_ctx != NULL((void*)0)) {
EVP_AEAD_CTX_cleanup(rp->aead_ctx);
freezero(rp->aead_ctx, sizeof(*rp->aead_ctx));
}

tls13_secret_cleanup(&rp->iv);
tls13_secret_cleanup(&rp->nonce);

memset(rp, 0, sizeof(*rp));
52}

54void
55tls13_record_protection_free(struct tls13_record_protection *rp)
56{
if (rp == NULL((void*)0))
return;

tls13_record_protection_clear(rp);

freezero(rp, sizeof(struct tls13_record_protection));
63}

65struct tls13_record_layer {
uint16_t legacy_version;

int ccs_allowed;
int ccs_seen;
int ccs_sent;
int handshake_completed;
int legacy_alerts_allowed;
int phh;
int phh_retry;

/*
* Read and/or write channels are closed due to an alert being
* sent or received. In the case of an error alert both channels
* are closed, whereas in the case of a close notify only one
* channel is closed.
*/
int read_closed;
int write_closed;

struct tls13_record *rrec;

struct tls13_record *wrec;
uint8_t wrec_content_type;
size_t wrec_appdata_len;
size_t wrec_content_len;

/* Alert to be sent on return from current read handler. */
uint8_t alert;

/* Pending alert messages. */
uint8_t *alert_data;
size_t alert_len;
uint8_t alert_level;
uint8_t alert_desc;

/* Pending post-handshake handshake messages (RFC 8446, section 4.6). */
CBS phh_cbs;
uint8_t *phh_data;
size_t phh_len;

/* Content from opened records. */
struct tls_content *rcontent;

/* Record protection. */
const EVP_MD *hash;
const EVP_AEAD *aead;
struct tls13_record_protection *read;
struct tls13_record_protection *write;

/* Callbacks. */
struct tls13_record_layer_callbacks cb;
void *cb_arg;
118};

120static void
121tls13_record_layer_rrec_free(struct tls13_record_layer *rl)
122{
tls13_record_free(rl->rrec);
rl->rrec = NULL((void*)0);
125}

127static void
128tls13_record_layer_wrec_free(struct tls13_record_layer *rl)
129{
tls13_record_free(rl->wrec);
rl->wrec = NULL((void*)0);
132}

134struct tls13_record_layer *
135tls13_record_layer_new(const struct tls13_record_layer_callbacks *callbacks,
  void *cb_arg)
137{
struct tls13_record_layer *rl;

if ((rl = calloc(1, sizeof(struct tls13_record_layer))) == NULL((void*)0))
goto err;

if ((rl->rcontent = tls_content_new()) == NULL((void*)0))
goto err;

if ((rl->read = tls13_record_protection_new()) == NULL((void*)0))
goto err;
if ((rl->write = tls13_record_protection_new()) == NULL((void*)0))
goto err;

rl->legacy_version = TLS1_2_VERSION0x0303;
rl->cb = *callbacks;
rl->cb_arg = cb_arg;

return rl;

err:
tls13_record_layer_free(rl);

return NULL((void*)0);
161}

163void
164tls13_record_layer_free(struct tls13_record_layer *rl)
165{
if (rl == NULL((void*)0))
return;

tls13_record_layer_rrec_free(rl);
tls13_record_layer_wrec_free(rl);

freezero(rl->alert_data, rl->alert_len);
freezero(rl->phh_data, rl->phh_len);

tls_content_free(rl->rcontent);

tls13_record_protection_free(rl->read);
tls13_record_protection_free(rl->write);

freezero(rl, sizeof(struct tls13_record_layer));
181}

183void
184tls13_record_layer_rcontent(struct tls13_record_layer *rl, CBS *cbs)
185{
CBS_dup(tls_content_cbs(rl->rcontent), cbs);
187}

189static const uint8_t tls13_max_seq_num[TLS13_RECORD_SEQ_NUM_LEN8] = {
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
191};

193int
194tls13_record_layer_inc_seq_num(uint8_t *seq_num)
195{
int i;

/* RFC 8446 section 5.3 - sequence numbers must not wrap. */
if (memcmp(seq_num, tls13_max_seq_num, TLS13_RECORD_SEQ_NUM_LEN8) == 0)
return 0;

for (i = TLS13_RECORD_SEQ_NUM_LEN8 - 1; i >= 0; i--) {
if (++seq_num[i] != 0)
	break;
}

return 1;
208}

210static int
211tls13_record_layer_update_nonce(struct tls13_secret *nonce,
  struct tls13_secret *iv, uint8_t *seq_num)
213{
ssize_t i, j;

if (nonce->len != iv->len)
return 0;

/*
* RFC 8446 section 5.3 - sequence number is zero padded and XOR'd
* with the IV to produce a per-record nonce. The IV will also be
* at least 8-bytes in length.
*/
for (i = nonce->len - 1, j = TLS13_RECORD_SEQ_NUM_LEN8 - 1; i >= 0; i--, j--)
nonce->data[i] = iv->data[i] ^ (j >= 0 ? seq_num[j] : 0);

return 1;
228}

230void
231tls13_record_layer_allow_ccs(struct tls13_record_layer *rl, int allow)
232{
rl->ccs_allowed = allow;
234}

236void
237tls13_record_layer_allow_legacy_alerts(struct tls13_record_layer *rl, int allow)
238{
rl->legacy_alerts_allowed = allow;
240}

242void
243tls13_record_layer_set_aead(struct tls13_record_layer *rl,
  const EVP_AEAD *aead)
245{
rl->aead = aead;
247}

249void
250tls13_record_layer_set_hash(struct tls13_record_layer *rl,
  const EVP_MD *hash)
252{
rl->hash = hash;
254}

256void
257tls13_record_layer_set_legacy_version(struct tls13_record_layer *rl,
  uint16_t version)
259{
rl->legacy_version = version;
261}

263void
264tls13_record_layer_handshake_completed(struct tls13_record_layer *rl)
265{
rl->handshake_completed = 1;
267}

269void
270tls13_record_layer_set_retry_after_phh(struct tls13_record_layer *rl, int retry)
271{
rl->phh_retry = retry;
273}

275static ssize_t
276tls13_record_layer_process_alert(struct tls13_record_layer *rl)
277{
uint8_t alert_level, alert_desc;
ssize_t ret = TLS13_IO_FAILURE-1;

/*
* RFC 8446 - sections 5.1 and 6.
*
* A TLSv1.3 alert record can only contain a single alert - this means
* that processing the alert must consume all of the record. The alert
* will result in one of three things - continuation (user_cancelled),
* read channel closure (close_notify) or termination (all others).
*/
if (tls_content_type(rl->rcontent) != SSL3_RT_ALERT21)
return TLS13_IO_FAILURE-1;

if (!CBS_get_u8(tls_content_cbs(rl->rcontent), &alert_level))
return tls13_send_alert(rl, TLS13_ALERT_DECODE_ERROR50);
if (!CBS_get_u8(tls_content_cbs(rl->rcontent), &alert_desc))
return tls13_send_alert(rl, TLS13_ALERT_DECODE_ERROR50);

if (tls_content_remaining(rl->rcontent) != 0)
return tls13_send_alert(rl, TLS13_ALERT_DECODE_ERROR50);

tls_content_clear(rl->rcontent);

/*
* Alert level is ignored for closure alerts (RFC 8446 section 6.1),
* however for error alerts (RFC 8446 section 6.2), the alert level
* must be specified as fatal.
*/
if (alert_desc == TLS13_ALERT_CLOSE_NOTIFY0) {
rl->read_closed = 1;
ret = TLS13_IO_EOF0;
} else if (alert_desc == TLS13_ALERT_USER_CANCELED90) {
/* Ignored at the record layer. */
ret = TLS13_IO_WANT_RETRY-5;
} else if (alert_level == TLS13_ALERT_LEVEL_FATAL2) {
rl->read_closed = 1;
rl->write_closed = 1;
ret = TLS13_IO_ALERT-2;
} else if (rl->legacy_alerts_allowed &&
   alert_level == TLS13_ALERT_LEVEL_WARNING1) {
/* Ignored and not passed to the callback. */
return TLS13_IO_WANT_RETRY-5;
} else {
return tls13_send_alert(rl, TLS13_ALERT_ILLEGAL_PARAMETER47);
}

rl->cb.alert_recv(alert_desc, rl->cb_arg);

return ret;
328}

330static ssize_t
331tls13_record_layer_send_alert(struct tls13_record_layer *rl)
332{
ssize_t ret;

/* This has to fit into a single record, per RFC 8446 section 5.1. */
if ((ret = tls13_record_layer_write_record(rl, SSL3_RT_ALERT21,
   rl->alert_data, rl->alert_len)) != rl->alert_len) {
if (ret == TLS13_IO_EOF0)
	ret = TLS13_IO_ALERT-2;
return ret;
}

freezero(rl->alert_data, rl->alert_len);
rl->alert_data = NULL((void*)0);
rl->alert_len = 0;

if (rl->alert_desc == TLS13_ALERT_CLOSE_NOTIFY0) {
rl->write_closed = 1;
ret = TLS13_IO_SUCCESS1;
} else if (rl->alert_desc == TLS13_ALERT_USER_CANCELED90) {
/* Ignored at the record layer. */
ret = TLS13_IO_SUCCESS1;
} else {
rl->read_closed = 1;
rl->write_closed = 1;
ret = TLS13_IO_ALERT-2;
}

rl->cb.alert_sent(rl->alert_desc, rl->cb_arg);

return ret;
362}

364static ssize_t
365tls13_record_layer_send_phh(struct tls13_record_layer *rl)
366{
ssize_t ret;

/* Push out pending post-handshake handshake messages. */
if ((ret = tls13_record_layer_write_chunk(rl, SSL3_RT_HANDSHAKE22,
   CBS_data(&rl->phh_cbs), CBS_len(&rl->phh_cbs))) <= 0)
return ret;
if (!CBS_skip(&rl->phh_cbs, ret))
return TLS13_IO_FAILURE-1;
if (CBS_len(&rl->phh_cbs) != 0)
return TLS13_IO_WANT_RETRY-5;

freezero(rl->phh_data, rl->phh_len);
rl->phh_data = NULL((void*)0);
rl->phh_len = 0;

CBS_init(&rl->phh_cbs, rl->phh_data, rl->phh_len);

rl->cb.phh_sent(rl->cb_arg);

return TLS13_IO_SUCCESS1;
387}

389ssize_t
390tls13_record_layer_send_pending(struct tls13_record_layer *rl)
391{
/*
* If an alert is pending, then it needs to be sent. However,
* if we're already part of the way through sending post-handshake
* handshake messages, then we need to finish that first...
*/

if (rl->phh_data != NULL((void*)0) && CBS_len(&rl->phh_cbs) != rl->phh_len)
return tls13_record_layer_send_phh(rl);

if (rl->alert_data != NULL((void*)0))
return tls13_record_layer_send_alert(rl);

if (rl->phh_data != NULL((void*)0))
return tls13_record_layer_send_phh(rl);

return TLS13_IO_SUCCESS1;
408}

410static ssize_t
411tls13_record_layer_enqueue_alert(struct tls13_record_layer *rl,
  uint8_t alert_level, uint8_t alert_desc)
413{
CBB cbb;

if (rl->alert_data != NULL((void*)0))
return TLS13_IO_FAILURE-1;

if (!CBB_init(&cbb, 0))
goto err;

if (!CBB_add_u8(&cbb, alert_level))
goto err;
if (!CBB_add_u8(&cbb, alert_desc))
goto err;
if (!CBB_finish(&cbb, &rl->alert_data, &rl->alert_len))
goto err;

rl->alert_level = alert_level;
rl->alert_desc = alert_desc;

return tls13_record_layer_send_pending(rl);

err:
CBB_cleanup(&cbb);

return TLS13_IO_FAILURE-1;
438}

440ssize_t
441tls13_record_layer_phh(struct tls13_record_layer *rl, CBS *cbs)
442{
if (rl->phh_data != NULL((void*)0))
return TLS13_IO_FAILURE-1;

if (!CBS_stow(cbs, &rl->phh_data, &rl->phh_len))
return TLS13_IO_FAILURE-1;

CBS_init(&rl->phh_cbs, rl->phh_data, rl->phh_len);

return tls13_record_layer_send_pending(rl);
452}

454static int
455tls13_record_layer_set_traffic_key(const EVP_AEAD *aead, const EVP_MD *hash,
  struct tls13_record_protection *rp, struct tls13_secret *traffic_key)
457{
struct tls13_secret context = { .data = "", .len = 0 };
struct tls13_secret key = { .data = NULL((void*)0), .len = 0 };
int ret = 0;

tls13_record_protection_clear(rp);

if ((rp->aead_ctx = calloc(1, sizeof(*rp->aead_ctx))) == NULL((void*)0))
return 0;

if (!tls13_secret_init(&rp->iv, EVP_AEAD_nonce_length(aead)))
goto err;
if (!tls13_secret_init(&rp->nonce, EVP_AEAD_nonce_length(aead)))
goto err;
if (!tls13_secret_init(&key, EVP_AEAD_key_length(aead)))
goto err;

if (!tls13_hkdf_expand_label(&rp->iv, hash, traffic_key, "iv", &context))
goto err;
if (!tls13_hkdf_expand_label(&key, hash, traffic_key, "key", &context))
goto err;

if (!EVP_AEAD_CTX_init(rp->aead_ctx, aead, key.data, key.len,
   EVP_AEAD_DEFAULT_TAG_LENGTH0, NULL((void*)0)))
goto err;

ret = 1;

err:
tls13_secret_cleanup(&key);

return ret;
489}

491int
492tls13_record_layer_set_read_traffic_key(struct tls13_record_layer *rl,
  struct tls13_secret *read_key)
494{
return tls13_record_layer_set_traffic_key(rl->aead, rl->hash,
   rl->read, read_key);
497}

499int
500tls13_record_layer_set_write_traffic_key(struct tls13_record_layer *rl,
  struct tls13_secret *write_key)
502{
return tls13_record_layer_set_traffic_key(rl->aead, rl->hash,
   rl->write, write_key);
505}

507static int
508tls13_record_layer_open_record_plaintext(struct tls13_record_layer *rl)
509{
CBS cbs;

if (rl->aead != NULL((void*)0))
return 0;

/*
* We're still operating in plaintext mode, so just copy the
* content from the record to the plaintext buffer.
*/
if (!tls13_record_content(rl->rrec, &cbs))
return 0;

if (CBS_len(&cbs) > TLS13_RECORD_MAX_PLAINTEXT_LEN16384) {
rl->alert = TLS13_ALERT_RECORD_OVERFLOW22;
return 0;
}

if (!tls_content_dup_data(rl->rcontent,
   tls13_record_content_type(rl->rrec), CBS_data(&cbs), CBS_len(&cbs)))
return 0;

return 1;
532}

534static int
535tls13_record_layer_open_record_protected(struct tls13_record_layer *rl)
536{
CBS header, enc_record, inner;
uint8_t *content = NULL((void*)0);
size_t content_len = 0;
uint8_t content_type;
size_t out_len;

if (rl->aead == NULL((void*)0))
1
Assuming field 'aead' is not equal to NULL→
2
←
Taking false branch→
goto err;

if (!tls13_record_header(rl->rrec, &header))
3
←
Assuming the condition is false→
4
←
Taking false branch→
goto err;
if (!tls13_record_content(rl->rrec, &enc_record))
5
←
Assuming the condition is false→
6
←
Taking false branch→
goto err;

if ((content = calloc(1, CBS_len(&enc_record))) == NULL((void*)0))
7
←
Memory is allocated→
8
←
Assuming the condition is false→
9
←
Taking false branch→
goto err;
content_len = CBS_len(&enc_record);

if (!tls13_record_layer_update_nonce(&rl->read->nonce, &rl->read->iv,
10
←
Assuming the condition is false→
11
←
Taking false branch→
   rl->read->seq_num))
goto err;

if (!EVP_AEAD_CTX_open(rl->read->aead_ctx,
12
←
Assuming the condition is false→
13
←
Taking false branch→
   content, &out_len, content_len,
   rl->read->nonce.data, rl->read->nonce.len,
   CBS_data(&enc_record), CBS_len(&enc_record),
   CBS_data(&header), CBS_len(&header)))
goto err;

if (out_len > TLS13_RECORD_MAX_INNER_PLAINTEXT_LEN(16384 + 1)) {
14
←
Assuming the condition is false→
15
←
Taking false branch→
rl->alert = TLS13_ALERT_RECORD_OVERFLOW22;
goto err;
}

if (!tls13_record_layer_inc_seq_num(rl->read->seq_num))
16
←
Assuming the condition is false→
17
←
Taking false branch→
goto err;

/*
* The real content type is hidden at the end of the record content and
* it may be followed by padding that consists of one or more zeroes.
* Time to hunt for that elusive content type!
*/
CBS_init(&inner, content, out_len);
content_type = 0;
while (CBS_get_last_u8(&inner, &content_type)) {
18
←
Loop condition is false. Execution continues on line 585→
if (content_type != 0)
	break;
}
if (content_type == 0) {
19
←
Assuming 'content_type' is not equal to 0→
20
←
Taking false branch→
/* Unexpected message per RFC 8446 section 5.4. */
rl->alert = TLS13_ALERT_UNEXPECTED_MESSAGE10;
goto err;
}
if (CBS_len(&inner) > TLS13_RECORD_MAX_PLAINTEXT_LEN16384) {
21
←
Assuming the condition is false→
22
←
Taking false branch→
rl->alert = TLS13_ALERT_RECORD_OVERFLOW22;
goto err;
}

tls_content_set_data(rl->rcontent, content_type, CBS_data(&inner),
23
←
Potential leak of memory pointed to by 'content'
   CBS_len(&inner));

return 1;

err:
freezero(content, content_len);

return 0;
604}

606static int
607tls13_record_layer_open_record(struct tls13_record_layer *rl)
608{
if (rl->handshake_completed && rl->aead == NULL((void*)0))
return 0;

if (rl->aead == NULL((void*)0))
return tls13_record_layer_open_record_plaintext(rl);

return tls13_record_layer_open_record_protected(rl);
616}

618static int
619tls13_record_layer_seal_record_plaintext(struct tls13_record_layer *rl,
  uint8_t content_type, const uint8_t *content, size_t content_len)
621{
uint8_t *data = NULL((void*)0);
size_t data_len = 0;
CBB cbb, body;

/*
* Allow dummy CCS messages to be sent in plaintext even when
* record protection has been engaged, as long as the handshake
* has not yet completed.
*/
if (rl->handshake_completed)
return 0;
if (rl->aead != NULL((void*)0) && content_type != SSL3_RT_CHANGE_CIPHER_SPEC20)
return 0;

/*
* We're still operating in plaintext mode, so just copy the
* content into the record.
*/
if (!CBB_init(&cbb, TLS13_RECORD_HEADER_LEN5 + content_len))
goto err;

if (!CBB_add_u8(&cbb, content_type))
goto err;
if (!CBB_add_u16(&cbb, rl->legacy_version))
goto err;
if (!CBB_add_u16_length_prefixed(&cbb, &body))
goto err;
if (!CBB_add_bytes(&body, content, content_len))
goto err;

if (!CBB_finish(&cbb, &data, &data_len))
goto err;

if (!tls13_record_set_data(rl->wrec, data, data_len))
goto err;

rl->wrec_content_len = content_len;
rl->wrec_content_type = content_type;

return 1;

err:
CBB_cleanup(&cbb);
freezero(data, data_len);

return 0;
668}

670static int
671tls13_record_layer_seal_record_protected(struct tls13_record_layer *rl,
  uint8_t content_type, const uint8_t *content, size_t content_len)
673{
uint8_t *data = NULL((void*)0), *header = NULL((void*)0), *inner = NULL((void*)0);
size_t data_len = 0, header_len = 0, inner_len = 0;
uint8_t *enc_record;
size_t enc_record_len;
ssize_t ret = 0;
size_t out_len;
CBB cbb;

if (rl->aead == NULL((void*)0))
return 0;

memset(&cbb, 0, sizeof(cbb));

/* Build inner plaintext. */
if (!CBB_init(&cbb, content_len + 1))
goto err;
if (!CBB_add_bytes(&cbb, content, content_len))
goto err;
if (!CBB_add_u8(&cbb, content_type))
goto err;
/* XXX - padding? */
if (!CBB_finish(&cbb, &inner, &inner_len))
goto err;

if (inner_len > TLS13_RECORD_MAX_INNER_PLAINTEXT_LEN(16384 + 1))
goto err;

/* XXX EVP_AEAD_max_tag_len vs EVP_AEAD_CTX_tag_len. */
enc_record_len = inner_len + EVP_AEAD_max_tag_len(rl->aead);
if (enc_record_len > TLS13_RECORD_MAX_CIPHERTEXT_LEN((16384 + 1) + 255))
goto err;

/* Build the record header. */
if (!CBB_init(&cbb, TLS13_RECORD_HEADER_LEN5))
goto err;
if (!CBB_add_u8(&cbb, SSL3_RT_APPLICATION_DATA23))
goto err;
if (!CBB_add_u16(&cbb, TLS1_2_VERSION0x0303))
goto err;
if (!CBB_add_u16(&cbb, enc_record_len))
goto err;
if (!CBB_finish(&cbb, &header, &header_len))
goto err;

/* Build the actual record. */
if (!CBB_init(&cbb, TLS13_RECORD_HEADER_LEN5 + enc_record_len))
goto err;
if (!CBB_add_bytes(&cbb, header, header_len))
goto err;
if (!CBB_add_space(&cbb, &enc_record, enc_record_len))
goto err;
if (!CBB_finish(&cbb, &data, &data_len))
goto err;

if (!tls13_record_layer_update_nonce(&rl->write->nonce,
   &rl->write->iv, rl->write->seq_num))
goto err;

/*
* XXX - consider a EVP_AEAD_CTX_seal_iov() that takes an iovec...
* this would avoid a copy since the inner would be passed as two
* separate pieces.
*/
if (!EVP_AEAD_CTX_seal(rl->write->aead_ctx,
   enc_record, &out_len, enc_record_len,
   rl->write->nonce.data, rl->write->nonce.len,
   inner, inner_len, header, header_len))
goto err;

if (out_len != enc_record_len)
goto err;

if (!tls13_record_layer_inc_seq_num(rl->write->seq_num))
goto err;

if (!tls13_record_set_data(rl->wrec, data, data_len))
goto err;

rl->wrec_content_len = content_len;
rl->wrec_content_type = content_type;

data = NULL((void*)0);
data_len = 0;

ret = 1;

err:
CBB_cleanup(&cbb);

freezero(data, data_len);
freezero(header, header_len);
freezero(inner, inner_len);

return ret;
768}

770static int
771tls13_record_layer_seal_record(struct tls13_record_layer *rl,
  uint8_t content_type, const uint8_t *content, size_t content_len)
773{
if (rl->handshake_completed && rl->aead == NULL((void*)0))
return 0;

tls13_record_layer_wrec_free(rl);

if ((rl->wrec = tls13_record_new()) == NULL((void*)0))
return 0;

if (rl->aead == NULL((void*)0) || content_type == SSL3_RT_CHANGE_CIPHER_SPEC20)
return tls13_record_layer_seal_record_plaintext(rl,
    content_type, content, content_len);

return tls13_record_layer_seal_record_protected(rl, content_type,
   content, content_len);
788}

790static ssize_t
791tls13_record_layer_read_record(struct tls13_record_layer *rl)
792{
uint8_t content_type, ccs;
ssize_t ret;
CBS cbs;

if (rl->rrec == NULL((void*)0)) {
if ((rl->rrec = tls13_record_new()) == NULL((void*)0))
	goto err;
}

if ((ret = tls13_record_recv(rl->rrec, rl->cb.wire_read, rl->cb_arg)) <= 0) {
switch (ret) {
case TLS13_IO_RECORD_VERSION-7:
	return tls13_send_alert(rl, TLS13_ALERT_PROTOCOL_VERSION70);
case TLS13_IO_RECORD_OVERFLOW-8:
	return tls13_send_alert(rl, TLS13_ALERT_RECORD_OVERFLOW22);
}
return ret;
}

content_type = tls13_record_content_type(rl->rrec);

/*
* In response to a client hello we may receive an alert in a
* record with a legacy version. Otherwise enforce that the
* legacy record version is 0x0303 per RFC 8446, section 5.1.
*/
if (rl->legacy_version == TLS1_2_VERSION0x0303 &&
   tls13_record_version(rl->rrec) != TLS1_2_VERSION0x0303 &&
   (content_type != SSL3_RT_ALERT21 || !rl->legacy_alerts_allowed))
return tls13_send_alert(rl, TLS13_ALERT_PROTOCOL_VERSION70);

/*
* Bag of hacks ahead... after the first ClientHello message has been
* sent or received and before the peer's Finished message has been
* received, we may receive an unencrypted ChangeCipherSpec record
* (see RFC 8446 section 5 and appendix D.4). This record must be
* ignored.
*/
if (content_type == SSL3_RT_CHANGE_CIPHER_SPEC20) {
if (!rl->ccs_allowed || rl->ccs_seen >= 2)
	return tls13_send_alert(rl, TLS13_ALERT_UNEXPECTED_MESSAGE10);
if (!tls13_record_content(rl->rrec, &cbs))
	return tls13_send_alert(rl, TLS13_ALERT_DECODE_ERROR50);
if (!CBS_get_u8(&cbs, &ccs))
	return tls13_send_alert(rl, TLS13_ALERT_DECODE_ERROR50);
if (ccs != 1)
	return tls13_send_alert(rl, TLS13_ALERT_ILLEGAL_PARAMETER47);
rl->ccs_seen++;
tls13_record_layer_rrec_free(rl);
return TLS13_IO_WANT_RETRY-5;
}

/*
* Once record protection is engaged, we should only receive
* protected application data messages (aside from the
* dummy ChangeCipherSpec messages, handled above).
*/
if (rl->aead != NULL((void*)0) && content_type != SSL3_RT_APPLICATION_DATA23)
return tls13_send_alert(rl, TLS13_ALERT_UNEXPECTED_MESSAGE10);

if (!tls13_record_layer_open_record(rl))
goto err;

tls13_record_layer_rrec_free(rl);

/*
* On receiving a handshake or alert record with empty inner plaintext,
* we must terminate the connection with an unexpected_message alert.
* See RFC 8446 section 5.4.
*/
if (tls_content_remaining(rl->rcontent) == 0 &&
   (tls_content_type(rl->rcontent) == SSL3_RT_ALERT21 ||
    tls_content_type(rl->rcontent) == SSL3_RT_HANDSHAKE22))
return tls13_send_alert(rl, TLS13_ALERT_UNEXPECTED_MESSAGE10);

switch (tls_content_type(rl->rcontent)) {
case SSL3_RT_ALERT21:
return tls13_record_layer_process_alert(rl);

case SSL3_RT_HANDSHAKE22:
break;

case SSL3_RT_APPLICATION_DATA23:
if (!rl->handshake_completed)
	return tls13_send_alert(rl, TLS13_ALERT_UNEXPECTED_MESSAGE10);
break;

default:
return tls13_send_alert(rl, TLS13_ALERT_UNEXPECTED_MESSAGE10);
}

return TLS13_IO_SUCCESS1;

err:
return TLS13_IO_FAILURE-1;
888}

890static ssize_t
891tls13_record_layer_pending(struct tls13_record_layer *rl, uint8_t content_type)
892{
if (tls_content_type(rl->rcontent) != content_type)
return 0;

return tls_content_remaining(rl->rcontent);
897}

899static ssize_t
900tls13_record_layer_recv_phh(struct tls13_record_layer *rl)
901{
ssize_t ret = TLS13_IO_FAILURE-1;

rl->phh = 1;

/*
* The post handshake handshake receive callback is allowed to return:
*
* TLS13_IO_WANT_POLLIN  need more handshake data.
* TLS13_IO_WANT_POLLOUT got whole handshake message, response enqueued.
* TLS13_IO_SUCCESS	 got the whole handshake, nothing more to do.
* TLS13_IO_FAILURE	 something broke.
*/
if (rl->cb.phh_recv != NULL((void*)0))
ret = rl->cb.phh_recv(rl->cb_arg, tls_content_cbs(rl->rcontent));

tls_content_clear(rl->rcontent);

/* Leave post handshake handshake mode unless we need more data. */
if (ret != TLS13_IO_WANT_POLLIN-3)
rl->phh = 0;

if (ret == TLS13_IO_SUCCESS1) {
if (rl->phh_retry)
	return TLS13_IO_WANT_RETRY-5;

return TLS13_IO_WANT_POLLIN-3;
}

return ret;
931}

933static ssize_t
934tls13_record_layer_read_internal(struct tls13_record_layer *rl,
  uint8_t content_type, uint8_t *buf, size_t n, int peek)
936{
ssize_t ret;

if ((ret = tls13_record_layer_send_pending(rl)) != TLS13_IO_SUCCESS1)
return ret;

if (rl->read_closed)
return TLS13_IO_EOF0;

/* If necessary, pull up the next record. */
if (tls_content_remaining(rl->rcontent) == 0) {
if ((ret = tls13_record_layer_read_record(rl)) <= 0)
	return ret;

/*
 * We may have read a valid 0-byte application data record,
 * in which case we need to read the next record.
 */
if (tls_content_remaining(rl->rcontent) == 0)
	return TLS13_IO_WANT_POLLIN-3;
}

/*
* If we are in post handshake handshake mode, we must not see
* any record type that isn't a handshake until we are done.
*/
if (rl->phh && tls_content_type(rl->rcontent) != SSL3_RT_HANDSHAKE22)
return tls13_send_alert(rl, TLS13_ALERT_UNEXPECTED_MESSAGE10);

/*
* Handshake content can appear as post-handshake messages (yup,
* the RFC reused the same content type...), which means we can
* be trying to read application data and need to handle a
* post-handshake handshake message instead...
*/
if (tls_content_type(rl->rcontent) != content_type) {
if (tls_content_type(rl->rcontent) == SSL3_RT_HANDSHAKE22) {
	if (rl->handshake_completed)
		return tls13_record_layer_recv_phh(rl);
}
return tls13_send_alert(rl, TLS13_ALERT_UNEXPECTED_MESSAGE10);
}

if (peek)
return tls_content_peek(rl->rcontent, buf, n);

return tls_content_read(rl->rcontent, buf, n);
983}

985static ssize_t
986tls13_record_layer_peek(struct tls13_record_layer *rl, uint8_t content_type,
  uint8_t *buf, size_t n)
988{
ssize_t ret;

do {
ret = tls13_record_layer_read_internal(rl, content_type, buf, n, 1);
} while (ret == TLS13_IO_WANT_RETRY-5);

if (rl->alert != 0)
return tls13_send_alert(rl, rl->alert);

return ret;
999}

1001static ssize_t
1002tls13_record_layer_read(struct tls13_record_layer *rl, uint8_t content_type,
  uint8_t *buf, size_t n)
1004{
ssize_t ret;

do {
ret = tls13_record_layer_read_internal(rl, content_type, buf, n, 0);
} while (ret == TLS13_IO_WANT_RETRY-5);

if (rl->alert != 0)
return tls13_send_alert(rl, rl->alert);

return ret;
1015}

1017static ssize_t
1018tls13_record_layer_write_record(struct tls13_record_layer *rl,
  uint8_t content_type, const uint8_t *content, size_t content_len)
1020{
ssize_t ret;

if (rl->write_closed)
return TLS13_IO_EOF0;

/*
* If we pushed out application data while handling other messages,
* we need to return content length on the next call.
*/
if (content_type == SSL3_RT_APPLICATION_DATA23 &&
   rl->wrec_appdata_len != 0) {
ret = rl->wrec_appdata_len;
rl->wrec_appdata_len = 0;
return ret;
}

/* See if there is an existing record and attempt to push it out... */
if (rl->wrec != NULL((void*)0)) {
if ((ret = tls13_record_send(rl->wrec, rl->cb.wire_write,
    rl->cb_arg)) <= 0)
	return ret;
tls13_record_layer_wrec_free(rl);

if (rl->wrec_content_type == content_type) {
	ret = rl->wrec_content_len;
	rl->wrec_content_len = 0;
	rl->wrec_content_type = 0;
	return ret;
}

/*
 * The only partial record type should be application data.
 * All other cases are handled to completion.
 */
if (rl->wrec_content_type != SSL3_RT_APPLICATION_DATA23)
	return TLS13_IO_FAILURE-1;
rl->wrec_appdata_len = rl->wrec_content_len;
}

if (content_len > TLS13_RECORD_MAX_PLAINTEXT_LEN16384)
goto err;

if (!tls13_record_layer_seal_record(rl, content_type, content, content_len))
goto err;

if ((ret = tls13_record_send(rl->wrec, rl->cb.wire_write, rl->cb_arg)) <= 0)
return ret;

tls13_record_layer_wrec_free(rl);

return content_len;

err:
return TLS13_IO_FAILURE-1;
1075}

1077static ssize_t
1078tls13_record_layer_write_chunk(struct tls13_record_layer *rl,
  uint8_t content_type, const uint8_t *buf, size_t n)
1080{
if (n > TLS13_RECORD_MAX_PLAINTEXT_LEN16384)
n = TLS13_RECORD_MAX_PLAINTEXT_LEN16384;

return tls13_record_layer_write_record(rl, content_type, buf, n);
1085}

1087static ssize_t
1088tls13_record_layer_write(struct tls13_record_layer *rl, uint8_t content_type,
  const uint8_t *buf, size_t n)
1090{
ssize_t ret;

do {
ret = tls13_record_layer_send_pending(rl);
} while (ret == TLS13_IO_WANT_RETRY-5);
if (ret != TLS13_IO_SUCCESS1)
return ret;

do {
ret = tls13_record_layer_write_chunk(rl, content_type, buf, n);
} while (ret == TLS13_IO_WANT_RETRY-5);

return ret;
1104}

1106ssize_t
1107tls13_record_layer_flush(struct tls13_record_layer *rl)
1108{
return rl->cb.wire_flush(rl->cb_arg);
1110}

1112static const uint8_t tls13_dummy_ccs[] = { 0x01 };

1114ssize_t
1115tls13_send_dummy_ccs(struct tls13_record_layer *rl)
1116{
ssize_t ret;

if (rl->ccs_sent)
return TLS13_IO_FAILURE-1;

if ((ret = tls13_record_layer_write(rl, SSL3_RT_CHANGE_CIPHER_SPEC20,
   tls13_dummy_ccs, sizeof(tls13_dummy_ccs))) <= 0)
return ret;

rl->ccs_sent = 1;

return TLS13_IO_SUCCESS1;
1129}

1131ssize_t
1132tls13_read_handshake_data(struct tls13_record_layer *rl, uint8_t *buf, size_t n)
1133{
return tls13_record_layer_read(rl, SSL3_RT_HANDSHAKE22, buf, n);
1135}

1137ssize_t
1138tls13_write_handshake_data(struct tls13_record_layer *rl, const uint8_t *buf,
  size_t n)
1140{
return tls13_record_layer_write(rl, SSL3_RT_HANDSHAKE22, buf, n);
1142}

1144ssize_t
1145tls13_pending_application_data(struct tls13_record_layer *rl)
1146{
if (!rl->handshake_completed)
return 0;

return tls13_record_layer_pending(rl, SSL3_RT_APPLICATION_DATA23);
1151}

1153ssize_t
1154tls13_peek_application_data(struct tls13_record_layer *rl, uint8_t *buf, size_t n)
1155{
if (!rl->handshake_completed)
return TLS13_IO_FAILURE-1;

return tls13_record_layer_peek(rl, SSL3_RT_APPLICATION_DATA23, buf, n);
1160}

1162ssize_t
1163tls13_read_application_data(struct tls13_record_layer *rl, uint8_t *buf, size_t n)
1164{
if (!rl->handshake_completed)
return TLS13_IO_FAILURE-1;

return tls13_record_layer_read(rl, SSL3_RT_APPLICATION_DATA23, buf, n);
1169}

1171ssize_t
1172tls13_write_application_data(struct tls13_record_layer *rl, const uint8_t *buf,
  size_t n)
1174{
if (!rl->handshake_completed)
return TLS13_IO_FAILURE-1;

return tls13_record_layer_write(rl, SSL3_RT_APPLICATION_DATA23, buf, n);
1179}

1181ssize_t
1182tls13_send_alert(struct tls13_record_layer *rl, uint8_t alert_desc)
1183{
uint8_t alert_level = TLS13_ALERT_LEVEL_FATAL2;
ssize_t ret;

if (alert_desc == TLS13_ALERT_CLOSE_NOTIFY0 ||
   alert_desc == TLS13_ALERT_USER_CANCELED90)
alert_level = TLS13_ALERT_LEVEL_WARNING1;

do {
ret = tls13_record_layer_enqueue_alert(rl, alert_level,
    alert_desc);
} while (ret == TLS13_IO_WANT_RETRY-5);

return ret;
1197}