/* ssl/d1_enc.c */

 /* 

  * DTLS implementation written by Nagendra Modadugu

  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  

  */

 /* ====================================================================

  * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.

  *

  * Redistribution and use in source and binary forms, with or without

  * modification, are permitted provided that the following conditions

  * are met:

  *

  * 1. Redistributions of source code must retain the above copyright

  *    notice, this list of conditions and the following disclaimer. 

  *

  * 2. Redistributions in binary form must reproduce the above copyright

  *    notice, this list of conditions and the following disclaimer in

  *    the documentation and/or other materials provided with the

  *    distribution.

  *

  * 3. All advertising materials mentioning features or use of this

  *    software must display the following acknowledgment:

  *    "This product includes software developed by the OpenSSL Project

  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"

  *

  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

  *    endorse or promote products derived from this software without

  *    prior written permission. For written permission, please contact

  *    openssl-core@openssl.org.

  *

  * 5. Products derived from this software may not be called "OpenSSL"

  *    nor may "OpenSSL" appear in their names without prior written

  *    permission of the OpenSSL Project.

  *

  * 6. Redistributions of any form whatsoever must retain the following

  *    acknowledgment:

  *    "This product includes software developed by the OpenSSL Project

  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"

  *

  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

  * OF THE POSSIBILITY OF SUCH DAMAGE.

  * ====================================================================

  *

  * This product includes cryptographic software written by Eric Young

  * (eay@cryptsoft.com).  This product includes software written by Tim

  * Hudson (tjh@cryptsoft.com).

  *

  */

 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)

  * All rights reserved.

  *

  * This package is an SSL implementation written

  * by Eric Young (eay@cryptsoft.com).

  * The implementation was written so as to conform with Netscapes SSL.

  * 

  * This library is free for commercial and non-commercial use as long as

  * the following conditions are aheared to.  The following conditions

  * apply to all code found in this distribution, be it the RC4, RSA,

  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation

  * included with this distribution is covered by the same copyright terms

  * except that the holder is Tim Hudson (tjh@cryptsoft.com).

  * 

  * Copyright remains Eric Young's, and as such any Copyright notices in

  * the code are not to be removed.

  * If this package is used in a product, Eric Young should be given attribution

  * as the author of the parts of the library used.

  * This can be in the form of a textual message at program startup or

  * in documentation (online or textual) provided with the package.

  * 

  * Redistribution and use in source and binary forms, with or without

  * modification, are permitted provided that the following conditions

  * are met:

  * 1. Redistributions of source code must retain the copyright

  *    notice, this list of conditions and the following disclaimer.

  * 2. Redistributions in binary form must reproduce the above copyright

  *    notice, this list of conditions and the following disclaimer in the

  *    documentation and/or other materials provided with the distribution.

  * 3. All advertising materials mentioning features or use of this software

  *    must display the following acknowledgement:

  *    "This product includes cryptographic software written by

  *     Eric Young (eay@cryptsoft.com)"

  *    The word 'cryptographic' can be left out if the rouines from the library

  *    being used are not cryptographic related :-).

  * 4. If you include any Windows specific code (or a derivative thereof) from 

  *    the apps directory (application code) you must include an acknowledgement:

  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"

  * 

  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND

  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE

  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

  * SUCH DAMAGE.

  * 

  * The licence and distribution terms for any publically available version or

  * derivative of this code cannot be changed.  i.e. this code cannot simply be

  * copied and put under another distribution licence

  * [including the GNU Public Licence.]

  */

 #include <stdio.h>

 #include "ssl_locl.h"

 #include <openssl/comp.h>

 #include <openssl/evp.h>

 #include <openssl/hmac.h>

 #include <openssl/md5.h>

 #include <openssl/rand.h>

 int dtls1_enc(SSL *s, int send)

 	{

 	SSL3_RECORD *rec;

 	EVP_CIPHER_CTX *ds;

 	unsigned long l;

 	int bs,i,ii,j,k,n=0;

 	const EVP_CIPHER *enc;

 	if (send)

 		{

 		if (s->write_hash != NULL)

 			n=EVP_MD_size(s->write_hash);

 		ds=s->enc_write_ctx;

 		rec= &(s->s3->wrec);

 		if (s->enc_write_ctx == NULL)

 			enc=NULL;

 		else

 			{

 			enc=EVP_CIPHER_CTX_cipher(s->enc_write_ctx);

 			if ( rec->data != rec->input)

 				/* we can't write into the input stream */

 				fprintf(stderr, "%s:%d: rec->data != rec->input\n",

 					__FILE__, __LINE__);

 			else if ( EVP_CIPHER_block_size(ds->cipher) > 1)

 				{

 				if (!RAND_bytes(rec->input, EVP_CIPHER_block_size(ds->cipher)))

 					return -1;

 				}

 			}

 		}

 	else

 		{

 		if (s->read_hash != NULL)

 			n=EVP_MD_size(s->read_hash);

 		ds=s->enc_read_ctx;

 		rec= &(s->s3->rrec);

 		if (s->enc_read_ctx == NULL)

 			enc=NULL;

 		else

 			enc=EVP_CIPHER_CTX_cipher(s->enc_read_ctx);

 		}

 #ifdef KSSL_DEBUG

 	printf("dtls1_enc(%d)\n", send);

 #endif    /* KSSL_DEBUG */

 	if ((s->session == NULL) || (ds == NULL) ||

 		(enc == NULL))

 		{

 		memmove(rec->data,rec->input,rec->length);

 		rec->input=rec->data;

 		}

 	else

 		{

 		l=rec->length;

 		bs=EVP_CIPHER_block_size(ds->cipher);

 		if ((bs != 1) && send)

 			{

 			i=bs-((int)l%bs);

 			/* Add weird padding of upto 256 bytes */

 			/* we need to add 'i' padding bytes of value j */

 			j=i-1;

 			if (s->options & SSL_OP_TLS_BLOCK_PADDING_BUG)

 				{

 				if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)

 					j++;

 				}

 			for (k=(int)l; k<(int)(l+i); k++)

 				rec->input[k]=j;

 			l+=i;

 			rec->length+=i;

 			}

 #ifdef KSSL_DEBUG

 		{

                 unsigned long ui;

 		printf("EVP_Cipher(ds=%p,rec->data=%p,rec->input=%p,l=%ld) ==>\n",

                         ds,rec->data,rec->input,l);

 		printf("\tEVP_CIPHER_CTX: %d buf_len, %d key_len [%d %d], %d iv_len\n",

                         ds->buf_len, ds->cipher->key_len,

                         DES_KEY_SZ, DES_SCHEDULE_SZ,

                         ds->cipher->iv_len);

 		printf("\t\tIV: ");

 		for (i=0; i<ds->cipher->iv_len; i++) printf("%02X", ds->iv[i]);

 		printf("\n");

 		printf("\trec->input=");

 		for (ui=0; ui<l; ui++) printf(" %02x", rec->input[ui]);

 		printf("\n");

 		}

 #endif	/* KSSL_DEBUG */

 		if (!send)

 			{

 			if (l == 0 || l%bs != 0)

 				{

 				SSLerr(SSL_F_DTLS1_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);

 				ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED);

 				return 0;

 				}

 			}

 		EVP_Cipher(ds,rec->data,rec->input,l);

 #ifdef KSSL_DEBUG

 		{

                 unsigned long i;

                 printf("\trec->data=");

 		for (i=0; i<l; i++)

                         printf(" %02x", rec->data[i]);  printf("\n");

                 }

 #endif	/* KSSL_DEBUG */

 		if ((bs != 1) && !send)

 			{

 			ii=i=rec->data[l-1]; /* padding_length */

 			i++;

 			if (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG)

 				{

 				/* First packet is even in size, so check */

 				if ((memcmp(s->s3->read_sequence,

 					"\0\0\0\0\0\0\0\0",8) == 0) && !(ii & 1))

 					s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;

 				if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)

 					i--;

 				}

 			/* TLS 1.0 does not bound the number of padding bytes by the block size.

 			 * All of them must have value 'padding_length'. */

 			if (i > (int)rec->length)

 				{

 				/* Incorrect padding. SSLerr() and ssl3_alert are done

 				 * by caller: we don't want to reveal whether this is

 				 * a decryption error or a MAC verification failure

 				 * (see http://www.openssl.org/~bodo/tls-cbc.txt) 

 				 */

 				return -1;

 				}

 			for (j=(int)(l-i); j<(int)l; j++)

 				{

 				if (rec->data[j] != ii)

 					{

 					/* Incorrect padding */

 					return -1;

 					}

 				}

 			rec->length-=i;

 			rec->data += bs;    /* skip the implicit IV */

 			rec->input += bs;

 			rec->length -= bs;

 			}

 		}

 	return(1);

 	}