From b2da74ca508745f00bb3d6b35cbe34d5031e27e7 Mon Sep 17 00:00:00 2001
From: Jack Lloyd <lloyd@randombit.net>
Date: Sun, 25 Oct 2015 22:25:40 -0400
Subject: TLS improvements

Use constant time operations when checking CBC padding in TLS decryption

Fix a bug in decoding ClientHellos that prevented DTLS rehandshakes
from working: on decode the session id and hello cookie would be
swapped, causing confusion between client and server.

Various changes in the service of finding the above DTLS bug that
should have been done before now anyway - better control of handshake
timeouts (via TLS::Policy), better reporting of handshake state in the
case of an error, and finally expose the facility for per-message
application callbacks.
---
 src/lib/utils/ct_utils.h | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

(limited to 'src/lib/utils')

diff --git a/src/lib/utils/ct_utils.h b/src/lib/utils/ct_utils.h
index 52a3bc388..2ea07b382 100644
--- a/src/lib/utils/ct_utils.h
+++ b/src/lib/utils/ct_utils.h
@@ -51,6 +51,12 @@ inline void unpoison(T* p, size_t n)
 #endif
    }
 
+template<typename T>
+inline void unpoison(T& p)
+   {
+   unpoison(&p, 1);
+   }
+
 /*
 * T should be an unsigned machine integer type
 * Expand to a mask used for other operations
@@ -89,6 +95,16 @@ inline T is_equal(T x, T y)
    return is_zero(x ^ y);
    }
 
+template<typename T>
+inline T is_less(T x, T y)
+   {
+   /*
+   This expands to a constant time sequence with GCC 5.2.0 on x86-64
+   but something more complicated may be needed for portable const time.
+   */
+   return expand_mask<T>(x < y);
+   }
+
 template<typename T>
 inline void conditional_copy_mem(T value,
                                  T* to,
@@ -102,6 +118,26 @@ inline void conditional_copy_mem(T value,
       to[i] = CT::select(mask, from0[i], from1[i]);
    }
 
+template<typename T>
+inline T expand_top_bit(T a)
+   {
+   return expand_mask<T>(a >> (sizeof(T)*8-1));
+   }
+
+template<typename T>
+inline T max(T a, T b)
+   {
+   const T a_larger = b - a; // negative if a is larger
+   return select(expand_top_bit(a), a, b);
+   }
+
+template<typename T>
+inline T min(T a, T b)
+   {
+   const T a_larger = b - a; // negative if a is larger
+   return select(expand_top_bit(b), b, a);
+   }
+
 }
 
 }
-- 
cgit v1.2.3