githubmirror/gnutls

lib/cipher.c
844 строки23 KB
Daiki Ueno
devel: make local header inclusion consistent
09 окт 2023, 01:13
09 окт 2023, 01:13a723409
/*
 * Copyright (C) 2000-2013 Free Software Foundation, Inc.
 * Copyright (C) 2013 Nikos Mavrogiannopoulos
 * Copyright (C) 2017-2018 Red Hat, Inc.
 *
 * Author: Nikos Mavrogiannopoulos
 *
 * This file is part of GnuTLS.
 *
 * The GnuTLS is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>
 *
 */

/* Some high level functions to be used in the record encryption are
 * included here.
 */

#include "gnutls_int.h"
#include "errors.h"
#include "cipher.h"
#include "algorithms.h"
#include "hash_int.h"
#include "cipher_int.h"
#include "debug.h"
#include "num.h"
#include "datum.h"
#include "kx.h"
#include "record.h"
#include "constate.h"
#include "mbuffers.h"
#include "state.h"
#include "random.h"

#include <nettle/memxor.h>

static int encrypt_packet(gnutls_session_t session, uint8_t *cipher_data,
			  int cipher_size, gnutls_datum_t *plain,
			  size_t min_pad, content_type_t _type,
			  record_parameters_st *params);

static int decrypt_packet(gnutls_session_t session, gnutls_datum_t *ciphertext,
			  gnutls_datum_t *plain, content_type_t type,
			  record_parameters_st *params, uint64_t sequence);

static int decrypt_packet_tls13(gnutls_session_t session,
				gnutls_datum_t *ciphertext,
				gnutls_datum_t *plain, content_type_t *type,
				record_parameters_st *params,
				uint64_t sequence);

static int encrypt_packet_tls13(gnutls_session_t session, uint8_t *cipher_data,
				size_t cipher_size, gnutls_datum_t *plain,
				size_t pad_size, uint8_t type,
				record_parameters_st *params);

/* returns ciphertext which contains the headers too. This also
 * calculates the size in the header field.
 *
 */
int _gnutls_encrypt(gnutls_session_t session, const uint8_t *data,
		    size_t data_size, size_t min_pad, mbuffer_st *bufel,
		    content_type_t type, record_parameters_st *params)
{
	gnutls_datum_t plaintext;
	const version_entry_st *vers =
		(session->internals.hsk_flags & HSK_EARLY_DATA_IN_FLIGHT) &&
				!IS_SERVER(session) ?
			session->internals.resumed_security_parameters.pversion :
			get_version(session);
	int ret;

	plaintext.data = (uint8_t *)data;
	plaintext.size = data_size;

	if (vers && vers->tls13_sem) {
		/* it fills the header, as it is included in the authenticated
		 * data of the AEAD cipher. */
		ret = encrypt_packet_tls13(session,
					   _mbuffer_get_udata_ptr(bufel),
					   _mbuffer_get_udata_size(bufel),
					   &plaintext, min_pad, type, params);
		if (ret < 0)
			return gnutls_assert_val(ret);
	} else {
		ret = encrypt_packet(session, _mbuffer_get_udata_ptr(bufel),
				     _mbuffer_get_udata_size(bufel), &plaintext,
				     min_pad, type, params);
		if (ret < 0)
			return gnutls_assert_val(ret);
	}

	if (IS_DTLS(session))
		_gnutls_write_uint16(
			ret, ((uint8_t *)_mbuffer_get_uhead_ptr(bufel)) + 11);
	else
		_gnutls_write_uint16(
			ret, ((uint8_t *)_mbuffer_get_uhead_ptr(bufel)) + 3);

	_mbuffer_set_udata_size(bufel, ret);
	_mbuffer_set_uhead_size(bufel, 0);

	return _mbuffer_get_udata_size(bufel);
}

/* Decrypts the given data.
 * Returns the decrypted data length.
 *
 * The output is preallocated with the maximum allowed data size.
 */
int _gnutls_decrypt(gnutls_session_t session, gnutls_datum_t *ciphertext,
		    gnutls_datum_t *output, content_type_t *type,
		    record_parameters_st *params, uint64_t sequence)
{
	int ret;
	const version_entry_st *vers = get_version(session);

	if (ciphertext->size == 0)
		return 0;

	if (vers && vers->tls13_sem)
		ret = decrypt_packet_tls13(session, ciphertext, output, type,
					   params, sequence);
	else
		ret = decrypt_packet(session, ciphertext, output, *type, params,
				     sequence);
	if (ret < 0)
		return gnutls_assert_val(ret);

	return ret;
}

inline static int calc_enc_length_block(gnutls_session_t session,
					const version_entry_st *ver,
					int data_size, int hash_size,
					uint8_t *pad, unsigned auth_cipher,
					uint16_t blocksize, unsigned etm)
{
	/* pad is the LH pad the user wants us to add. Besides
	 * this LH pad, we only add minimal padding
	 */
	unsigned int pre_length = data_size + *pad;
	unsigned int length, new_pad;

	if (etm == 0)
		pre_length += hash_size;

	new_pad = (uint8_t)(blocksize - (pre_length % blocksize)) + *pad;

	if (new_pad > 255)
		new_pad -= blocksize;
	*pad = new_pad;

	length = data_size + hash_size + *pad;

	if (_gnutls_version_has_explicit_iv(ver))
		length += blocksize; /* for the IV */

	return length;
}

inline static int calc_enc_length_stream(gnutls_session_t session,
					 int data_size, int hash_size,
					 unsigned auth_cipher,
					 unsigned exp_iv_size)
{
	unsigned int length;

	length = data_size + hash_size;
	if (auth_cipher)
		length += exp_iv_size;

	return length;
}

/* generates the authentication data (data to be hashed only
 * and are not to be sent). Returns their size.
 */
int _gnutls_make_preamble(uint64_t uint64_data, uint8_t type,
			  unsigned int length, const version_entry_st *ver,
			  uint8_t preamble[MAX_PREAMBLE_SIZE])
{
	uint8_t *p = preamble;
	uint16_t c_length;

	c_length = _gnutls_conv_uint16(length);

	_gnutls_write_uint64(uint64_data, p);
	p += 8;
	*p = type;
	p++;
#ifdef ENABLE_SSL3
	if (ver->id != GNUTLS_SSL3)
#endif
	{ /* TLS protocols */
		*p = ver->major;
		p++;
		*p = ver->minor;
		p++;
	}
	memcpy(p, &c_length, 2);
	p += 2;
	return p - preamble;
}

/* This is the actual encryption
 * Encrypts the given plaintext datum, and puts the result to cipher_data,
 * which has cipher_size size.
 * return the actual encrypted data length.
 */
static int encrypt_packet(gnutls_session_t session, uint8_t *cipher_data,
			  int cipher_size, gnutls_datum_t *plain,
			  size_t min_pad, content_type_t type,
			  record_parameters_st *params)
{
	uint8_t pad;
	int length, ret;
	uint8_t preamble[MAX_PREAMBLE_SIZE];
	int preamble_size;
	int tag_size = _gnutls_auth_cipher_tag_len(&params->write.ctx.tls12);
	int blocksize = _gnutls_cipher_get_block_size(params->cipher);
	unsigned algo_type = _gnutls_cipher_type(params->cipher);
	uint8_t *data_ptr, *full_cipher_ptr;
	const version_entry_st *ver = get_version(session);
	int explicit_iv = _gnutls_version_has_explicit_iv(ver);
	int auth_cipher = _gnutls_auth_cipher_is_aead(&params->write.ctx.tls12);
	uint8_t nonce[MAX_CIPHER_IV_SIZE];
	unsigned imp_iv_size = 0, exp_iv_size = 0;
	bool etm = 0;

	if (unlikely(ver == NULL))
		return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

	if (algo_type == CIPHER_BLOCK && params->etm != 0)
		etm = 1;

	_gnutls_hard_log("ENC[%p]: cipher: %s, MAC: %s, Epoch: %u\n", session,
			 _gnutls_cipher_get_name(params->cipher),
			 _gnutls_mac_get_name(params->mac),
			 (unsigned int)params->epoch);

	/* Calculate the encrypted length (padding etc.)
	 */
	if (algo_type == CIPHER_BLOCK) {
		/* Call gnutls_rnd() once. Get data used for the IV
		 */
		ret = gnutls_rnd(GNUTLS_RND_NONCE, nonce, blocksize);
		if (ret < 0)
			return gnutls_assert_val(ret);

		pad = min_pad;

		length = calc_enc_length_block(session, ver, plain->size,
					       tag_size, &pad, auth_cipher,
					       blocksize, etm);
	} else { /* AEAD + STREAM */
		imp_iv_size =
			_gnutls_cipher_get_implicit_iv_size(params->cipher);
		exp_iv_size =
			_gnutls_cipher_get_explicit_iv_size(params->cipher);

		pad = 0;
		length = calc_enc_length_stream(session, plain->size, tag_size,
						auth_cipher, exp_iv_size);
	}

	if (length < 0)
		return gnutls_assert_val(length);

	/* copy the encrypted data to cipher_data.
	 */
	if (cipher_size < length)
		return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

	data_ptr = cipher_data;
	full_cipher_ptr = data_ptr;

	if (algo_type == CIPHER_BLOCK || algo_type == CIPHER_STREAM) {
		if (algo_type == CIPHER_BLOCK && explicit_iv != 0) {
			/* copy the random IV.
			 */
			memcpy(data_ptr, nonce, blocksize);
			ret = _gnutls_auth_cipher_setiv(
				&params->write.ctx.tls12, data_ptr, blocksize);
			if (ret < 0)
				return gnutls_assert_val(ret);

			/*data_ptr += blocksize; */
			cipher_data += blocksize;
		}
	} else { /* AEAD */
		if ((params->cipher->flags & GNUTLS_CIPHER_FLAG_XOR_NONCE) ==
		    0) {
			/* Values in AEAD are pretty fixed in TLS 1.2 for 128-bit block
			 */
			if (params->write.iv_size != imp_iv_size)
				return gnutls_assert_val(
					GNUTLS_E_INTERNAL_ERROR);

			/* Instead of generating a new nonce on every packet, we use the
			 * write.sequence_number (It is a MAY on RFC 5288), and safer
			 * as it will never reuse a value.
			 */
			memcpy(nonce, params->write.iv, params->write.iv_size);
			_gnutls_write_uint64(params->write.sequence_number,
					     &nonce[imp_iv_size]);

			memcpy(data_ptr, &nonce[imp_iv_size], exp_iv_size);

			/*data_ptr += exp_iv_size; */
			cipher_data += exp_iv_size;
		} else { /* XOR nonce with IV */
			if (unlikely(params->write.iv_size != 12 ||
				     imp_iv_size != 12 || exp_iv_size != 0))
				return gnutls_assert_val(
					GNUTLS_E_INTERNAL_ERROR);

			memset(nonce, 0, 4);
			_gnutls_write_uint64(params->write.sequence_number,
					     &nonce[4]);

			memxor(nonce, params->write.iv, 12);
		}
	}

	if (etm)
		ret = length - tag_size;
	else
		ret = plain->size;

	preamble_size = _gnutls_make_preamble(params->write.sequence_number,
					      type, ret, ver, preamble);

	if (algo_type == CIPHER_BLOCK || algo_type == CIPHER_STREAM) {
		/* add the authenticated data */
		ret = _gnutls_auth_cipher_add_auth(&params->write.ctx.tls12,
						   preamble, preamble_size);
		if (ret < 0)
			return gnutls_assert_val(ret);

		if (etm && explicit_iv) {
			/* In EtM we need to hash the IV as well */
			ret = _gnutls_auth_cipher_add_auth(
				&params->write.ctx.tls12, full_cipher_ptr,
				blocksize);
			if (ret < 0)
				return gnutls_assert_val(ret);
		}

		/* Actual encryption.
		 */
		ret = _gnutls_auth_cipher_encrypt2_tag(&params->write.ctx.tls12,
						       plain->data, plain->size,
						       cipher_data, cipher_size,
						       pad);
		if (ret < 0)
			return gnutls_assert_val(ret);
	} else { /* AEAD */
		ret = _gnutls_aead_cipher_encrypt(
			&params->write.ctx.tls12.cipher, nonce,
			imp_iv_size + exp_iv_size, preamble, preamble_size,
			tag_size, plain->data, plain->size, cipher_data,
			cipher_size);
		if (ret < 0)
			return gnutls_assert_val(ret);
	}

	return length;
}

static int encrypt_packet_tls13(gnutls_session_t session, uint8_t *cipher_data,
				size_t cipher_size, gnutls_datum_t *plain,
				size_t pad_size, uint8_t type,
				record_parameters_st *params)
{
	int ret;
	unsigned int tag_size = params->write.aead_tag_size;
	const version_entry_st *ver = get_version(session);
	uint8_t nonce[MAX_CIPHER_IV_SIZE];
	unsigned iv_size = 0;
	ssize_t max, total;
	uint8_t aad[5];
	giovec_t auth_iov[1];
	giovec_t iov[2];

	if (unlikely(ver == NULL))
		return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

	_gnutls_hard_log("ENC[%p]: cipher: %s, MAC: %s, Epoch: %u\n", session,
			 _gnutls_cipher_get_name(params->cipher),
			 _gnutls_mac_get_name(params->mac),
			 (unsigned int)params->epoch);

	iv_size = params->write.iv_size;

	if (params->cipher->id == GNUTLS_CIPHER_NULL) {
		if (cipher_size < plain->size + 1)
			return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
		memcpy(cipher_data, plain->data, plain->size);
		return plain->size;
	}

	if (unlikely(iv_size < 8))
		return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

	memset(nonce, 0, iv_size - 8);
	_gnutls_write_uint64(params->write.sequence_number,
			     &nonce[iv_size - 8]);
	memxor(nonce, params->write.iv, iv_size);

	max = max_record_send_size(session) + MAX_RECORD_SEND_OVERHEAD(session);

	/* make TLS 1.3 form of data */
	total = plain->size + 1 + pad_size;

	/* check whether padding would exceed max */
	if (total > max) {
		if (unlikely(max < (ssize_t)plain->size + 1))
			return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

		pad_size = max - plain->size - 1;
		total = max;
	}

	/* create authenticated data header */
	aad[0] = GNUTLS_APPLICATION_DATA;
	aad[1] = 0x03;
	aad[2] = 0x03;
	_gnutls_write_uint16(total + tag_size, &aad[3]);

	auth_iov[0].iov_base = aad;
	auth_iov[0].iov_len = sizeof(aad);

	iov[0].iov_base = plain->data;
	iov[0].iov_len = plain->size;

	if (pad_size ||
	    (session->internals.flags & GNUTLS_SAFE_PADDING_CHECK)) {
		uint8_t *pad = gnutls_calloc(1, 1 + pad_size);
		if (pad == NULL)
			return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);

		pad[0] = type;

		iov[1].iov_base = pad;
		iov[1].iov_len = 1 + pad_size;

		ret = gnutls_aead_cipher_encryptv(&params->write.ctx.aead,
						  nonce, iv_size, auth_iov, 1,
						  tag_size, iov, 2, cipher_data,
						  &cipher_size);
		gnutls_free(pad);
	} else {
		iov[1].iov_base = &type;
		iov[1].iov_len = 1;

		ret = gnutls_aead_cipher_encryptv(&params->write.ctx.aead,
						  nonce, iv_size, auth_iov, 1,
						  tag_size, iov, 2, cipher_data,
						  &cipher_size);
	}

	if (ret < 0)
		return gnutls_assert_val(ret);

	return cipher_size;
}

/* Deciphers the ciphertext packet, and puts the result to plain.
 * Returns the actual plaintext packet size.
 */
static int decrypt_packet(gnutls_session_t session, gnutls_datum_t *ciphertext,
			  gnutls_datum_t *plain, content_type_t type,
			  record_parameters_st *params, uint64_t sequence)
{
	uint8_t tag[MAX_HASH_SIZE];
	uint8_t nonce[MAX_CIPHER_IV_SIZE];
	const uint8_t *tag_ptr = NULL;
	unsigned int pad = 0;
	int length, length_to_decrypt;
	uint16_t blocksize;
	int ret;
	uint8_t preamble[MAX_PREAMBLE_SIZE];
	unsigned int preamble_size = 0;
	const version_entry_st *ver = get_version(session);
	unsigned int tag_size =
		_gnutls_auth_cipher_tag_len(&params->read.ctx.tls12);
	unsigned int explicit_iv = _gnutls_version_has_explicit_iv(ver);
	unsigned imp_iv_size, exp_iv_size;
	unsigned cipher_type = _gnutls_cipher_type(params->cipher);
	bool etm = 0;

	if (unlikely(ver == NULL))
		return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

	imp_iv_size = _gnutls_cipher_get_implicit_iv_size(params->cipher);
	exp_iv_size = _gnutls_cipher_get_explicit_iv_size(params->cipher);
	blocksize = _gnutls_cipher_get_block_size(params->cipher);

	if (params->etm != 0 && cipher_type == CIPHER_BLOCK)
		etm = 1;

	/* if EtM mode and not AEAD */
	if (etm) {
		if (unlikely(ciphertext->size < tag_size))
			return gnutls_assert_val(
				GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

		preamble_size = _gnutls_make_preamble(
			sequence, type, ciphertext->size - tag_size, ver,
			preamble);

		ret = _gnutls_auth_cipher_add_auth(&params->read.ctx.tls12,
						   preamble, preamble_size);
		if (unlikely(ret < 0))
			return gnutls_assert_val(ret);

		ret = _gnutls_auth_cipher_add_auth(&params->read.ctx.tls12,
						   ciphertext->data,
						   ciphertext->size - tag_size);
		if (unlikely(ret < 0))
			return gnutls_assert_val(ret);

		ret = _gnutls_auth_cipher_tag(&params->read.ctx.tls12, tag,
					      tag_size);
		if (unlikely(ret < 0))
			return gnutls_assert_val(ret);

		if (unlikely(gnutls_memcmp(tag,
					   &ciphertext->data[ciphertext->size -
							     tag_size],
					   tag_size) != 0)) {
			/* HMAC was not the same. */
			return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);
		}
	}

	/* actual decryption (inplace)
	 */
	switch (cipher_type) {
	case CIPHER_AEAD:
		/* The way AEAD ciphers are defined in RFC5246, it allows
		 * only stream ciphers.
		 */
		if (unlikely(_gnutls_auth_cipher_is_aead(
				     &params->read.ctx.tls12) == 0))
			return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

		if (unlikely(ciphertext->size < (tag_size + exp_iv_size)))
			return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

		if ((params->cipher->flags & GNUTLS_CIPHER_FLAG_XOR_NONCE) ==
		    0) {
			/* Values in AEAD are pretty fixed in TLS 1.2 for 128-bit block
			 */
			if (unlikely(params->read.iv_size != 4))
				return gnutls_assert_val(
					GNUTLS_E_DECRYPTION_FAILED);

			memcpy(nonce, params->read.iv, imp_iv_size);

			memcpy(&nonce[imp_iv_size], ciphertext->data,
			       exp_iv_size);

			ciphertext->data += exp_iv_size;
			ciphertext->size -= exp_iv_size;
		} else { /* XOR nonce with IV */
			if (unlikely(params->read.iv_size != 12 ||
				     imp_iv_size != 12 || exp_iv_size != 0))
				return gnutls_assert_val(
					GNUTLS_E_DECRYPTION_FAILED);

			memset(nonce, 0, 4);
			_gnutls_write_uint64(sequence, &nonce[4]);

			memxor(nonce, params->read.iv, 12);
		}

		length = ciphertext->size - tag_size;

		length_to_decrypt = ciphertext->size;

		/* Pass the type, version, length and plain through
		 * MAC.
		 */
		preamble_size = _gnutls_make_preamble(sequence, type, length,
						      ver, preamble);

		if (unlikely((unsigned)length_to_decrypt > plain->size)) {
			_gnutls_audit_log(
				session,
				"Received %u bytes, while expecting less than %u\n",
				(unsigned int)length_to_decrypt,
				(unsigned int)plain->size);
			return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);
		}

		ret = _gnutls_aead_cipher_decrypt(
			&params->read.ctx.tls12.cipher, nonce,
			exp_iv_size + imp_iv_size, preamble, preamble_size,
			tag_size, ciphertext->data, length_to_decrypt,
			plain->data, plain->size);
		if (unlikely(ret < 0))
			return gnutls_assert_val(ret);

		return length;

		break;
	case CIPHER_STREAM:
		if (unlikely(ciphertext->size < tag_size))
			return gnutls_assert_val(
				GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

		length_to_decrypt = ciphertext->size;
		length = ciphertext->size - tag_size;
		tag_ptr = plain->data + length;

		/* Pass the type, version, length and plain through
		 * MAC.
		 */
		preamble_size = _gnutls_make_preamble(sequence, type, length,
						      ver, preamble);

		ret = _gnutls_auth_cipher_add_auth(&params->read.ctx.tls12,
						   preamble, preamble_size);
		if (unlikely(ret < 0))
			return gnutls_assert_val(ret);

		if (unlikely((unsigned)length_to_decrypt > plain->size)) {
			_gnutls_audit_log(
				session,
				"Received %u bytes, while expecting less than %u\n",
				(unsigned int)length_to_decrypt,
				(unsigned int)plain->size);
			return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);
		}

		ret = _gnutls_auth_cipher_decrypt2(&params->read.ctx.tls12,
						   ciphertext->data,
						   length_to_decrypt,
						   plain->data, plain->size);

		if (unlikely(ret < 0))
			return gnutls_assert_val(ret);

		ret = _gnutls_auth_cipher_tag(&params->read.ctx.tls12, tag,
					      tag_size);
		if (unlikely(ret < 0))
			return gnutls_assert_val(ret);

		if (unlikely(gnutls_memcmp(tag, tag_ptr, tag_size) != 0)) {
			return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);
		}

		break;
	case CIPHER_BLOCK:
		if (unlikely(ciphertext->size < blocksize))
			return gnutls_assert_val(
				GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

		if (etm == 0) {
			if (unlikely(ciphertext->size % blocksize != 0))
				return gnutls_assert_val(
					GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
		} else {
			if (unlikely((ciphertext->size - tag_size) %
					     blocksize !=
				     0))
				return gnutls_assert_val(
					GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
		}

		/* ignore the IV in TLS 1.1+
		 */
		if (explicit_iv) {
			ret = _gnutls_auth_cipher_setiv(&params->read.ctx.tls12,
							ciphertext->data,
							blocksize);
			if (ret < 0)
				return gnutls_assert_val(ret);

			memcpy(nonce, ciphertext->data, blocksize);
			ciphertext->size -= blocksize;
			ciphertext->data += blocksize;
		}

		if (unlikely(ciphertext->size < tag_size + 1))
			return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

		/* we don't use the auth_cipher interface here, since
		 * TLS with block ciphers is impossible to be used under such
		 * an API. (the length of plaintext is required to calculate
		 * auth_data, but it is not available before decryption).
		 */
		if (unlikely(ciphertext->size > plain->size))
			return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

		if (etm == 0) {
			ret = _gnutls_cipher_decrypt2(
				&params->read.ctx.tls12.cipher,
				ciphertext->data, ciphertext->size, plain->data,
				plain->size);
			if (unlikely(ret < 0))
				return gnutls_assert_val(ret);

			ret = cbc_mac_verify(session, params, preamble, type,
					     sequence, plain->data,
					     ciphertext->size, tag_size);
			if (unlikely(ret < 0))
				return gnutls_assert_val(ret);

			length = ret;
		} else { /* EtM */
			ret = _gnutls_cipher_decrypt2(
				&params->read.ctx.tls12.cipher,
				ciphertext->data, ciphertext->size - tag_size,
				plain->data, plain->size);
			if (unlikely(ret < 0))
				return gnutls_assert_val(ret);

			pad = plain->data[ciphertext->size - tag_size -
					  1]; /* pad */
			length = ciphertext->size - tag_size - pad - 1;

			if (unlikely(length < 0))
				return gnutls_assert_val(
					GNUTLS_E_DECRYPTION_FAILED);
		}
		break;
	default:
		return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);
	}

	return length;
}

static int decrypt_packet_tls13(gnutls_session_t session,
				gnutls_datum_t *ciphertext,
				gnutls_datum_t *plain, content_type_t *type,
				record_parameters_st *params, uint64_t sequence)
{
	uint8_t nonce[MAX_CIPHER_IV_SIZE];
	size_t length, length_to_decrypt;
	int ret;
	const version_entry_st *ver = get_version(session);
	unsigned int tag_size = params->read.aead_tag_size;
	unsigned iv_size;
	unsigned j;
	volatile unsigned length_set;
	uint8_t aad[5];

	if (unlikely(ver == NULL))
		return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

	if (params->cipher->id == GNUTLS_CIPHER_NULL) {
		if (plain->size < ciphertext->size)
			return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

		length = ciphertext->size;
		memcpy(plain->data, ciphertext->data, length);

		return length;
	}

	iv_size = _gnutls_cipher_get_iv_size(params->cipher);

	/* The way AEAD ciphers are defined in RFC5246, it allows
	 * only stream ciphers.
	 */
	if (unlikely(ciphertext->size < tag_size))
		return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

	if (unlikely(params->read.iv_size != iv_size || iv_size < 8))
		return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

	memset(nonce, 0, iv_size - 8);
	_gnutls_write_uint64(sequence, &nonce[iv_size - 8]);
	memxor(nonce, params->read.iv, params->read.iv_size);

	length = ciphertext->size - tag_size;

	length_to_decrypt = ciphertext->size;

	if (unlikely((unsigned)length_to_decrypt > plain->size)) {
		_gnutls_audit_log(
			session,
			"Received %u bytes, while expecting less than %u\n",
			(unsigned int)length_to_decrypt,
			(unsigned int)plain->size);
		return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);
	}

	aad[0] = GNUTLS_APPLICATION_DATA;
	aad[1] = 0x03;
	aad[2] = 0x03;
	_gnutls_write_uint16(ciphertext->size, &aad[3]);

	ret = gnutls_aead_cipher_decrypt(&params->read.ctx.aead, nonce, iv_size,
					 aad, sizeof(aad), tag_size,
					 ciphertext->data, length_to_decrypt,
					 plain->data, &length);
	if (unlikely(ret < 0))
		return gnutls_assert_val(ret);

	/* 1 octet for content type */
	if (length > max_decrypted_size(session) + 1) {
		_gnutls_audit_log(session,
				  "Received packet with illegal length: %u\n",
				  (unsigned int)length);

		return gnutls_assert_val(GNUTLS_E_RECORD_OVERFLOW);
	}

	length_set = 0;

	/* now figure the actual data size. We intentionally iterate through all data,
	 * to avoid leaking the padding length due to timing differences in processing.
	 */
	for (j = length; j > 0; j--) {
		if (plain->data[j - 1] != 0 && length_set == 0) {
			*type = plain->data[j - 1];
			length = j - 1;
			length_set = 1;
			if (!(session->internals.flags &
			      GNUTLS_SAFE_PADDING_CHECK))
				break;
		}
	}

	if (!length_set)
		return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);

	return length;
}