CVE-2013-0169: Make CBC decoding constant time

(cherry-picked from 2c082d25fc3f0dd6e56c45407fe10638b904083c)

Bug: 8017911
Bug: 8095088
Change-Id: I57556e120fd1f585d38739d0d6aaf02bcbe45fbd

3 files changed, 1789 insertions, 0 deletions

diff --git a/patches/0001-Add-and-use-a-constant-time-memcmp.patch b/patches/0001-Add-and-use-a-constant-time-memcmp.patch
new file mode 100644
index 0000000..a593d49
--- /dev/null
+++ b/patches/0001-Add-and-use-a-constant-time-memcmp.patch
@@ -0,0 +1,155 @@
+From 306d003174cb4e5994734b20d741867aeeebf918 Mon Sep 17 00:00:00 2001
+From: Adam Langley <agl@chromium.org>
+Date: Wed, 16 Jan 2013 11:02:35 -0500
+Subject: [PATCH 1/2] Add and use a constant-time memcmp.
+
+This change adds CRYPTO_memcmp, which compares two vectors of bytes in
+an amount of time that's independent of their contents. It also changes
+several MAC compares in the code to use this over the standard memcmp,
+which may leak information about the size of a matching prefix.
+---
+ crypto/cryptlib.c     | 13 +++++++++++++
+ crypto/crypto.h       |  7 +++++++
+ crypto/rsa/rsa_oaep.c |  2 +-
+ ssl/d1_pkt.c          |  2 +-
+ ssl/s2_clnt.c         |  2 +-
+ ssl/s2_pkt.c          |  3 +--
+ ssl/s3_both.c         |  2 +-
+ ssl/s3_pkt.c          |  2 +-
+ ssl/t1_lib.c          |  2 +-
+ 9 files changed, 27 insertions(+), 8 deletions(-)
+
+diff --git a/crypto/cryptlib.c b/crypto/cryptlib.c
+index a7cb420..304c6b7 100644
+--- a/crypto/cryptlib.c
++++ b/crypto/cryptlib.c
+@@ -925,3 +925,16 @@ void OpenSSLDie(const char *file,int line,const char *assertion)
+ 	}
+ 
+ void *OPENSSL_stderr(void)	{ return stderr; }
++
++int CRYPTO_memcmp(const void *in_a, const void *in_b, size_t len)
++	{
++	size_t i;
++	const unsigned char *a = in_a;
++	const unsigned char *b = in_b;
++	unsigned char x = 0;
++
++	for (i = 0; i < len; i++)
++		x |= a[i] ^ b[i];
++
++	return x;
++	}
+diff --git a/crypto/crypto.h b/crypto/crypto.h
+index 6160576..f92fc51 100644
+--- a/crypto/crypto.h
++++ b/crypto/crypto.h
+@@ -574,6 +574,13 @@ void OPENSSL_init(void);
+ #define fips_cipher_abort(alg) while(0)
+ #endif
+ 
++/* CRYPTO_memcmp returns zero iff the |len| bytes at |a| and |b| are equal. It
++ * takes an amount of time dependent on |len|, but independent of the contents
++ * of |a| and |b|. Unlike memcmp, it cannot be used to put elements into a
++ * defined order as the return value when a != b is undefined, other than to be
++ * non-zero. */
++int CRYPTO_memcmp(const void *a, const void *b, size_t len);
++
+ /* BEGIN ERROR CODES */
+ /* The following lines are auto generated by the script mkerr.pl. Any changes
+  * made after this point may be overwritten when the script is next run.
+diff --git a/crypto/rsa/rsa_oaep.c b/crypto/rsa/rsa_oaep.c
+index 553d212..af4d24a 100644
+--- a/crypto/rsa/rsa_oaep.c
++++ b/crypto/rsa/rsa_oaep.c
+@@ -149,7 +149,7 @@ int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen,
+ 	if (!EVP_Digest((void *)param, plen, phash, NULL, EVP_sha1(), NULL))
+ 		return -1;
+ 
+-	if (memcmp(db, phash, SHA_DIGEST_LENGTH) != 0 || bad)
++	if (CRYPTO_memcmp(db, phash, SHA_DIGEST_LENGTH) != 0 || bad)
+ 		goto decoding_err;
+ 	else
+ 		{
+diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c
+index 987af60..5e2c56c 100644
+--- a/ssl/d1_pkt.c
++++ b/ssl/d1_pkt.c
+@@ -463,7 +463,7 @@ printf("\n");
+ 		else
+ 			rr->length = 0;
+ 		i=s->method->ssl3_enc->mac(s,md,0);
+-		if (i < 0 || mac == NULL || memcmp(md, mac, mac_size) != 0)
++		if (i < 0 || mac == NULL || CRYPTO_memcmp(md,mac,mac_size) != 0)
+ 			{
+ 			decryption_failed_or_bad_record_mac = 1;
+ 			}
+diff --git a/ssl/s2_clnt.c b/ssl/s2_clnt.c
+index 76b690e..03b6cf9 100644
+--- a/ssl/s2_clnt.c
++++ b/ssl/s2_clnt.c
+@@ -939,7 +939,7 @@ static int get_server_verify(SSL *s)
+ 		s->msg_callback(0, s->version, 0, p, len, s, s->msg_callback_arg); /* SERVER-VERIFY */
+ 	p += 1;
+ 
+-	if (memcmp(p,s->s2->challenge,s->s2->challenge_length) != 0)
++	if (CRYPTO_memcmp(p,s->s2->challenge,s->s2->challenge_length) != 0)
+ 		{
+ 		ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
+ 		SSLerr(SSL_F_GET_SERVER_VERIFY,SSL_R_CHALLENGE_IS_DIFFERENT);
+diff --git a/ssl/s2_pkt.c b/ssl/s2_pkt.c
+index ac963b2..8bb6ab8 100644
+--- a/ssl/s2_pkt.c
++++ b/ssl/s2_pkt.c
+@@ -269,8 +269,7 @@ static int ssl2_read_internal(SSL *s, void *buf, int len, int peek)
+ 			s->s2->ract_data_length-=mac_size;
+ 			ssl2_mac(s,mac,0);
+ 			s->s2->ract_data_length-=s->s2->padding;
+-			if (	(memcmp(mac,s->s2->mac_data,
+-				(unsigned int)mac_size) != 0) ||
++			if (	(CRYPTO_memcmp(mac,s->s2->mac_data,mac_size) != 0) ||
+ 				(s->s2->rlength%EVP_CIPHER_CTX_block_size(s->enc_read_ctx) != 0))
+ 				{
+ 				SSLerr(SSL_F_SSL2_READ_INTERNAL,SSL_R_BAD_MAC_DECODE);
+diff --git a/ssl/s3_both.c b/ssl/s3_both.c
+index 918da35..ead01c8 100644
+--- a/ssl/s3_both.c
++++ b/ssl/s3_both.c
+@@ -265,7 +265,7 @@ int ssl3_get_finished(SSL *s, int a, int b)
+ 		goto f_err;
+ 		}
+ 
+-	if (memcmp(p, s->s3->tmp.peer_finish_md, i) != 0)
++	if (CRYPTO_memcmp(p, s->s3->tmp.peer_finish_md, i) != 0)
+ 		{
+ 		al=SSL_AD_DECRYPT_ERROR;
+ 		SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_DIGEST_CHECK_FAILED);
+diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
+index dca3458..3e11140 100644
+--- a/ssl/s3_pkt.c
++++ b/ssl/s3_pkt.c
+@@ -463,7 +463,7 @@ printf("\n");
+ #endif
+ 			}
+ 		i=s->method->ssl3_enc->mac(s,md,0);
+-		if (i < 0 || mac == NULL || memcmp(md, mac, (size_t)mac_size) != 0)
++		if (i < 0 || mac == NULL || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0)
+ 			{
+ 			decryption_failed_or_bad_record_mac = 1;
+ 			}
+diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
+index d8df062..27010dd 100644
+--- a/ssl/t1_lib.c
++++ b/ssl/t1_lib.c
+@@ -2226,7 +2226,7 @@ static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
+ 	HMAC_Update(&hctx, etick, eticklen);
+ 	HMAC_Final(&hctx, tick_hmac, NULL);
+ 	HMAC_CTX_cleanup(&hctx);
+-	if (memcmp(tick_hmac, etick + eticklen, mlen))
++	if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen))
+ 		return 2;
+ 	/* Attempt to decrypt session data */
+ 	/* Move p after IV to start of encrypted ticket, update length */
+-- 
+1.8.1
+
diff --git a/patches/0002-Make-CBC-decoding-constant-time.patch b/patches/0002-Make-CBC-decoding-constant-time.patch
new file mode 100644
index 0000000..1893aa2
--- /dev/null
+++ b/patches/0002-Make-CBC-decoding-constant-time.patch
@@ -0,0 +1,1621 @@
+From fb402b7cdeffc907a9464cb84aa1311b1f77832a Mon Sep 17 00:00:00 2001
+From: Adam Langley <agl@chromium.org>
+Date: Wed, 16 Jan 2013 11:18:19 -0500
+Subject: [PATCH 2/2] Make CBC decoding constant time.
+
+This patch makes the decoding of SSLv3 and TLS CBC records constant
+time. Without this, a timing side-channel can be used to build a padding
+oracle and mount Vaudenay's attack.
+
+This patch also disables the stitched AESNI+SHA mode pending a similar
+fix to that code.
+
+In order to be easy to backport, this change is implemented in ssl/,
+rather than as a generic AEAD mode. In the future this should be changed
+around so that HMAC isn't in ssl/, but crypto/ as FIPS expects.
+---
+ crypto/evp/c_allc.c |   2 +
+ ssl/Makefile        |   4 +-
+ ssl/d1_enc.c        |  59 ++---
+ ssl/d1_pkt.c        |  87 ++++---
+ ssl/s3_cbc.c        | 696 ++++++++++++++++++++++++++++++++++++++++++++++++++++
+ ssl/s3_enc.c        | 119 +++++----
+ ssl/s3_pkt.c        |  94 +++----
+ ssl/ssl3.h          |   4 +
+ ssl/ssl_algs.c      |   3 +
+ ssl/ssl_locl.h      |  34 +++
+ ssl/t1_enc.c        | 144 +++++------
+ 11 files changed, 993 insertions(+), 253 deletions(-)
+ create mode 100644 ssl/s3_cbc.c
+
+diff --git a/crypto/evp/c_allc.c b/crypto/evp/c_allc.c
+index 2a45d43..e230e60 100644
+--- a/crypto/evp/c_allc.c
++++ b/crypto/evp/c_allc.c
+@@ -195,11 +195,13 @@ void OpenSSL_add_all_ciphers(void)
+ 	EVP_add_cipher(EVP_aes_256_xts());
+ 	EVP_add_cipher_alias(SN_aes_256_cbc,"AES256");
+ 	EVP_add_cipher_alias(SN_aes_256_cbc,"aes256");
++#if 0  /* Disabled because of timing side-channel leaks. */
+ #if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1)
+ 	EVP_add_cipher(EVP_aes_128_cbc_hmac_sha1());
+ 	EVP_add_cipher(EVP_aes_256_cbc_hmac_sha1());
+ #endif
+ #endif
++#endif
+ 
+ #ifndef OPENSSL_NO_CAMELLIA
+ 	EVP_add_cipher(EVP_camellia_128_ecb());
+diff --git a/ssl/Makefile b/ssl/Makefile
+index feaf3e3..bdb49e2 100644
+--- a/ssl/Makefile
++++ b/ssl/Makefile
+@@ -22,7 +22,7 @@ LIB=$(TOP)/libssl.a
+ SHARED_LIB= libssl$(SHLIB_EXT)
+ LIBSRC=	\
+ 	s2_meth.c   s2_srvr.c s2_clnt.c  s2_lib.c  s2_enc.c s2_pkt.c \
+-	s3_meth.c   s3_srvr.c s3_clnt.c  s3_lib.c  s3_enc.c s3_pkt.c s3_both.c \
++	s3_meth.c   s3_srvr.c s3_clnt.c  s3_lib.c  s3_enc.c s3_pkt.c s3_both.c s3_cbc.c \
+ 	s23_meth.c s23_srvr.c s23_clnt.c s23_lib.c          s23_pkt.c \
+ 	t1_meth.c   t1_srvr.c t1_clnt.c  t1_lib.c  t1_enc.c \
+ 	d1_meth.c   d1_srvr.c d1_clnt.c  d1_lib.c  d1_pkt.c \
+@@ -33,7 +33,7 @@ LIBSRC=	\
+ 	bio_ssl.c ssl_err.c kssl.c tls_srp.c t1_reneg.c
+ LIBOBJ= \
+ 	s2_meth.o  s2_srvr.o  s2_clnt.o  s2_lib.o  s2_enc.o s2_pkt.o \
+-	s3_meth.o  s3_srvr.o  s3_clnt.o  s3_lib.o  s3_enc.o s3_pkt.o s3_both.o \
++	s3_meth.o  s3_srvr.o  s3_clnt.o  s3_lib.o  s3_enc.o s3_pkt.o s3_both.o s3_cbc.o \
+ 	s23_meth.o s23_srvr.o s23_clnt.o s23_lib.o          s23_pkt.o \
+ 	t1_meth.o   t1_srvr.o t1_clnt.o  t1_lib.o  t1_enc.o \
+ 	d1_meth.o   d1_srvr.o d1_clnt.o  d1_lib.o  d1_pkt.o \
+diff --git a/ssl/d1_enc.c b/ssl/d1_enc.c
+index 07a5e97..712c464 100644
+--- a/ssl/d1_enc.c
++++ b/ssl/d1_enc.c
+@@ -126,20 +126,28 @@
+ #include <openssl/des.h>
+ #endif
+ 
++/* dtls1_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
++ *
++ * Returns:
++ *   0: (in non-constant time) if the record is publically invalid (i.e. too
++ *       short etc).
++ *   1: if the record's padding is valid / the encryption was successful.
++ *   -1: if the record's padding/AEAD-authenticator is invalid or, if sending,
++ *       an internal error occured. */
+ int dtls1_enc(SSL *s, int send)
+ 	{
+ 	SSL3_RECORD *rec;
+ 	EVP_CIPHER_CTX *ds;
+ 	unsigned long l;
+-	int bs,i,ii,j,k,n=0;
++	int bs,i,j,k,mac_size=0;
+ 	const EVP_CIPHER *enc;
+ 
+ 	if (send)
+ 		{
+ 		if (EVP_MD_CTX_md(s->write_hash))
+ 			{
+-			n=EVP_MD_CTX_size(s->write_hash);
+-			if (n < 0)
++			mac_size=EVP_MD_CTX_size(s->write_hash);
++			if (mac_size < 0)
+ 				return -1;
+ 			}
+ 		ds=s->enc_write_ctx;
+@@ -164,9 +172,8 @@ int dtls1_enc(SSL *s, int send)
+ 		{
+ 		if (EVP_MD_CTX_md(s->read_hash))
+ 			{
+-			n=EVP_MD_CTX_size(s->read_hash);
+-			if (n < 0)
+-				return -1;
++			mac_size=EVP_MD_CTX_size(s->read_hash);
++			OPENSSL_assert(mac_size >= 0);
+ 			}
+ 		ds=s->enc_read_ctx;
+ 		rec= &(s->s3->rrec);
+@@ -231,7 +238,7 @@ int dtls1_enc(SSL *s, int send)
+ 		if (!send)
+ 			{
+ 			if (l == 0 || l%bs != 0)
+-				return -1;
++				return 0;
+ 			}
+ 		
+ 		EVP_Cipher(ds,rec->data,rec->input,l);
+@@ -246,43 +253,7 @@ int dtls1_enc(SSL *s, int send)
+ #endif	/* KSSL_DEBUG */
+ 
+ 		if ((bs != 1) && !send)
+-			{
+-			ii=i=rec->data[l-1]; /* padding_length */
+-			i++;
+-			if (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG)
+-				{
+-				/* First packet is even in size, so check */
+-				if ((memcmp(s->s3->read_sequence,
+-					"\0\0\0\0\0\0\0\0",8) == 0) && !(ii & 1))
+-					s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;
+-				if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
+-					i--;
+-				}
+-			/* TLS 1.0 does not bound the number of padding bytes by the block size.
+-			 * All of them must have value 'padding_length'. */
+-			if (i + bs > (int)rec->length)
+-				{
+-				/* Incorrect padding. SSLerr() and ssl3_alert are done
+-				 * by caller: we don't want to reveal whether this is
+-				 * a decryption error or a MAC verification failure
+-				 * (see http://www.openssl.org/~bodo/tls-cbc.txt) 
+-				 */
+-				return -1;
+-				}
+-			for (j=(int)(l-i); j<(int)l; j++)
+-				{
+-				if (rec->data[j] != ii)
+-					{
+-					/* Incorrect padding */
+-					return -1;
+-					}
+-				}
+-			rec->length-=i;
+-
+-			rec->data += bs;    /* skip the implicit IV */
+-			rec->input += bs;
+-			rec->length -= bs;
+-			}
++			return tls1_cbc_remove_padding(s, rec, bs, mac_size);
+ 		}
+ 	return(1);
+ 	}
+diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c
+index 5e2c56c..02c881a 100644
+--- a/ssl/d1_pkt.c
++++ b/ssl/d1_pkt.c
+@@ -376,15 +376,11 @@ static int
+ dtls1_process_record(SSL *s)
+ {
+ 	int i,al;
+-	int clear=0;
+ 	int enc_err;
+ 	SSL_SESSION *sess;
+ 	SSL3_RECORD *rr;
+ 	unsigned int mac_size;
+ 	unsigned char md[EVP_MAX_MD_SIZE];
+-	int decryption_failed_or_bad_record_mac = 0;
+-	unsigned char *mac = NULL;
+-
+ 
+ 	rr= &(s->s3->rrec);
+ 	sess = s->session;
+@@ -414,14 +410,19 @@ dtls1_process_record(SSL *s)
+ 
+ 	/* decrypt in place in 'rr->input' */
+ 	rr->data=rr->input;
++	rr->orig_len=rr->length;
+ 
+ 	enc_err = s->method->ssl3_enc->enc(s,0);
+-	if (enc_err <= 0)
++	/* enc_err is:
++	 *    0: (in non-constant time) if the record is publically invalid.
++	 *    1: if the padding is valid
++	 *    -1: if the padding is invalid */
++	if (enc_err == 0)
+ 		{
+-		/* To minimize information leaked via timing, we will always
+-		 * perform all computations before discarding the message.
+-		 */
+-		decryption_failed_or_bad_record_mac = 1;
++		/* For DTLS we simply ignore bad packets. */
++		rr->length = 0;
++		s->packet_length = 0;
++		goto err;
+ 		}
+ 
+ #ifdef TLS_DEBUG
+@@ -431,45 +432,59 @@ printf("\n");
+ #endif
+ 
+ 	/* r->length is now the compressed data plus mac */
+-	if (	(sess == NULL) ||
+-		(s->enc_read_ctx == NULL) ||
+-		(s->read_hash == NULL))
+-		clear=1;
+-
+-	if (!clear)
++	if ((sess != NULL) &&
++	    (s->enc_read_ctx != NULL) &&
++	    (EVP_MD_CTX_md(s->read_hash) != NULL))
+ 		{
+-		/* !clear => s->read_hash != NULL => mac_size != -1 */
+-		int t;
+-		t=EVP_MD_CTX_size(s->read_hash);
+-		OPENSSL_assert(t >= 0);
+-		mac_size=t;
+-
+-		if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+mac_size)
++		/* s->read_hash != NULL => mac_size != -1 */
++		unsigned char *mac = NULL;
++		unsigned char mac_tmp[EVP_MAX_MD_SIZE];
++		mac_size=EVP_MD_CTX_size(s->read_hash);
++		OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);
++
++		/* orig_len is the length of the record before any padding was
++		 * removed. This is public information, as is the MAC in use,
++		 * therefore we can safely process the record in a different
++		 * amount of time if it's too short to possibly contain a MAC.
++		 */
++		if (rr->orig_len < mac_size ||
++		    /* CBC records must have a padding length byte too. */
++		    (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
++		     rr->orig_len < mac_size+1))
+ 			{
+-#if 0 /* OK only for stream ciphers (then rr->length is visible from ciphertext anyway) */
+-			al=SSL_AD_RECORD_OVERFLOW;
+-			SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);
++			al=SSL_AD_DECODE_ERROR;
++			SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT);
+ 			goto f_err;
+-#else
+-			decryption_failed_or_bad_record_mac = 1;
+-#endif			
+ 			}
+-		/* check the MAC for rr->input (it's in mac_size bytes at the tail) */
+-		if (rr->length >= mac_size)
++
++		if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE)
+ 			{
++			/* We update the length so that the TLS header bytes
++			 * can be constructed correctly but we need to extract
++			 * the MAC in constant time from within the record,
++			 * without leaking the contents of the padding bytes.
++			 * */
++			mac = mac_tmp;
++			ssl3_cbc_copy_mac(mac_tmp, rr, mac_size);
+ 			rr->length -= mac_size;
+-			mac = &rr->data[rr->length];
+ 			}
+ 		else
+-			rr->length = 0;
+-		i=s->method->ssl3_enc->mac(s,md,0);
+-		if (i < 0 || mac == NULL || CRYPTO_memcmp(md,mac,mac_size) != 0)
+ 			{
+-			decryption_failed_or_bad_record_mac = 1;
++			/* In this case there's no padding, so |rec->orig_len|
++			 * equals |rec->length| and we checked that there's
++			 * enough bytes for |mac_size| above. */
++			rr->length -= mac_size;
++			mac = &rr->data[rr->length];
+ 			}
++
++		i=s->method->ssl3_enc->mac(s,md,0 /* not send */);
++		if (i < 0 || mac == NULL || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0)
++			enc_err = -1;
++		if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+mac_size)
++			enc_err = -1;
+ 		}
+ 
+-	if (decryption_failed_or_bad_record_mac)
++	if (enc_err < 0)
+ 		{
+ 		/* decryption failed, silently discard message */
+ 		rr->length = 0;
+diff --git a/ssl/s3_cbc.c b/ssl/s3_cbc.c
+new file mode 100644
+index 0000000..e9b112c
+--- /dev/null
++++ b/ssl/s3_cbc.c
+@@ -0,0 +1,696 @@
++/* ssl/s3_cbc.c */
++/* ====================================================================
++ * Copyright (c) 2012 The OpenSSL Project.  All rights reserved.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ *
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ *
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in
++ *    the documentation and/or other materials provided with the
++ *    distribution.
++ *
++ * 3. All advertising materials mentioning features or use of this
++ *    software must display the following acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
++ *
++ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
++ *    endorse or promote products derived from this software without
++ *    prior written permission. For written permission, please contact
++ *    openssl-core@openssl.org.
++ *
++ * 5. Products derived from this software may not be called "OpenSSL"
++ *    nor may "OpenSSL" appear in their names without prior written
++ *    permission of the OpenSSL Project.
++ *
++ * 6. Redistributions of any form whatsoever must retain the following
++ *    acknowledgment:
++ *    "This product includes software developed by the OpenSSL Project
++ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
++ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
++ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
++ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
++ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
++ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
++ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
++ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
++ * OF THE POSSIBILITY OF SUCH DAMAGE.
++ * ====================================================================
++ *
++ * This product includes cryptographic software written by Eric Young
++ * (eay@cryptsoft.com).  This product includes software written by Tim
++ * Hudson (tjh@cryptsoft.com).
++ *
++ */
++
++#include <stdint.h>
++
++#include "ssl_locl.h"
++
++#include <openssl/md5.h>
++#include <openssl/sha.h>
++
++/* MAX_HASH_BIT_COUNT_BYTES is the maximum number of bytes in the hash's length
++ * field. (SHA-384/512 have 128-bit length.) */
++#define MAX_HASH_BIT_COUNT_BYTES 16
++
++/* MAX_HASH_BLOCK_SIZE is the maximum hash block size that we'll support.
++ * Currently SHA-384/512 has a 128-byte block size and that's the largest
++ * supported by TLS.) */
++#define MAX_HASH_BLOCK_SIZE 128
++
++/* Some utility functions are needed:
++ *
++ * These macros return the given value with the MSB copied to all the other
++ * bits. They use the fact that arithmetic shift shifts-in the sign bit.
++ * However, this is not ensured by the C standard so you may need to replace
++ * them with something else on odd CPUs. */
++#define DUPLICATE_MSB_TO_ALL(x) ( (unsigned)( (int)(x) >> (sizeof(int)*8-1) ) )
++#define DUPLICATE_MSB_TO_ALL_8(x) ((unsigned char)(DUPLICATE_MSB_TO_ALL(x)))
++
++/* constant_time_ge returns 0xff if a>=b and 0x00 otherwise. */
++static unsigned constant_time_ge(unsigned a, unsigned b)
++	{
++	a -= b;
++	return DUPLICATE_MSB_TO_ALL(~a);
++	}
++
++/* constant_time_eq_8 returns 0xff if a==b and 0x00 otherwise. */
++static unsigned char constant_time_eq_8(unsigned char a, unsigned char b)
++	{
++	unsigned c = a ^ b;
++	c--;
++	return DUPLICATE_MSB_TO_ALL_8(c);
++	}
++
++/* ssl3_cbc_remove_padding removes padding from the decrypted, SSLv3, CBC
++ * record in |rec| by updating |rec->length| in constant time.
++ *
++ * block_size: the block size of the cipher used to encrypt the record.
++ * returns:
++ *   0: (in non-constant time) if the record is publicly invalid.
++ *   1: if the padding was valid
++ *  -1: otherwise. */
++int ssl3_cbc_remove_padding(const SSL* s,
++			    SSL3_RECORD *rec,
++			    unsigned block_size,
++			    unsigned mac_size)
++	{
++	unsigned padding_length, good;
++	const unsigned overhead = 1 /* padding length byte */ + mac_size;
++
++	/* These lengths are all public so we can test them in non-constant
++	 * time. */
++	if (overhead > rec->length)
++		return 0;
++
++	padding_length = rec->data[rec->length-1];
++	good = constant_time_ge(rec->length, padding_length+overhead);
++	/* SSLv3 requires that the padding is minimal. */
++	good &= constant_time_ge(block_size, padding_length+1);
++	rec->length -= good & (padding_length+1);
++	return (int)((good & 1) | (~good & -1));
++}
++
++/* tls1_cbc_remove_padding removes the CBC padding from the decrypted, TLS, CBC
++ * record in |rec| in constant time and returns 1 if the padding is valid and
++ * -1 otherwise. It also removes any explicit IV from the start of the record
++ * without leaking any timing about whether there was enough space after the
++ * padding was removed.
++ *
++ * block_size: the block size of the cipher used to encrypt the record.
++ * returns:
++ *   0: (in non-constant time) if the record is publicly invalid.
++ *   1: if the padding was valid
++ *  -1: otherwise. */
++int tls1_cbc_remove_padding(const SSL* s,
++			    SSL3_RECORD *rec,
++			    unsigned block_size,
++			    unsigned mac_size)
++	{
++	unsigned padding_length, good, to_check, i;
++	const char has_explicit_iv =
++		s->version >= TLS1_1_VERSION || s->version == DTLS1_VERSION;
++	const unsigned overhead = 1 /* padding length byte */ +
++				  mac_size +
++				  (has_explicit_iv ? block_size : 0);
++
++	/* These lengths are all public so we can test them in non-constant
++	 * time. */
++	if (overhead > rec->length)
++		return 0;
++
++	padding_length = rec->data[rec->length-1];
++
++	/* NB: if compression is in operation the first packet may not be of
++	 * even length so the padding bug check cannot be performed. This bug
++	 * workaround has been around since SSLeay so hopefully it is either
++	 * fixed now or no buggy implementation supports compression [steve]
++	 */
++	if ( (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand)
++		{
++		/* First packet is even in size, so check */
++		if ((memcmp(s->s3->read_sequence, "\0\0\0\0\0\0\0\0",8) == 0) &&
++		    !(padding_length & 1))
++			{
++			s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;
++			}
++		if ((s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG) &&
++		    padding_length > 0)
++			{
++			padding_length--;
++			}
++		}
++
++	good = constant_time_ge(rec->length, overhead+padding_length);
++	/* The padding consists of a length byte at the end of the record and
++	 * then that many bytes of padding, all with the same value as the
++	 * length byte. Thus, with the length byte included, there are i+1
++	 * bytes of padding.
++	 *
++	 * We can't check just |padding_length+1| bytes because that leaks
++	 * decrypted information. Therefore we always have to check the maximum
++	 * amount of padding possible. (Again, the length of the record is
++	 * public information so we can use it.) */
++	to_check = 255; /* maximum amount of padding. */
++	if (to_check > rec->length-1)
++		to_check = rec->length-1;
++
++	for (i = 0; i < to_check; i++)
++		{
++		unsigned char mask = constant_time_ge(padding_length, i);
++		unsigned char b = rec->data[rec->length-1-i];
++		/* The final |padding_length+1| bytes should all have the value
++		 * |padding_length|. Therefore the XOR should be zero. */
++		good &= ~(mask&(padding_length ^ b));
++		}
++
++	/* If any of the final |padding_length+1| bytes had the wrong value,
++	 * one or more of the lower eight bits of |good| will be cleared. We
++	 * AND the bottom 8 bits together and duplicate the result to all the
++	 * bits. */
++	good &= good >> 4;
++	good &= good >> 2;
++	good &= good >> 1;
++	good <<= sizeof(good)*8-1;
++	good = DUPLICATE_MSB_TO_ALL(good);
++
++	rec->length -= good & (padding_length+1);
++
++	/* We can always safely skip the explicit IV. We check at the beginning
++	 * of this function that the record has at least enough space for the
++	 * IV, MAC and padding length byte. (These can be checked in
++	 * non-constant time because it's all public information.) So, if the
++	 * padding was invalid, then we didn't change |rec->length| and this is
++	 * safe. If the padding was valid then we know that we have at least
++	 * overhead+padding_length bytes of space and so this is still safe
++	 * because overhead accounts for the explicit IV. */
++	if (has_explicit_iv)
++		{
++		rec->data += block_size;
++		rec->input += block_size;
++		rec->length -= block_size;
++		rec->orig_len -= block_size;
++		}
++
++	return (int)((good & 1) | (~good & -1));
++	}
++
++#if defined(_M_AMD64) || defined(__x86_64__)
++#define CBC_MAC_ROTATE_IN_PLACE
++#endif
++
++/* ssl3_cbc_copy_mac copies |md_size| bytes from the end of |rec| to |out| in
++ * constant time (independent of the concrete value of rec->length, which may
++ * vary within a 256-byte window).
++ *
++ * ssl3_cbc_remove_padding or tls1_cbc_remove_padding must be called prior to
++ * this function.
++ *
++ * On entry:
++ *   rec->orig_len >= md_size
++ *   md_size <= EVP_MAX_MD_SIZE
++ *
++ * If CBC_MAC_ROTATE_IN_PLACE is defined then the rotation is performed with
++ * variable accesses in a 64-byte-aligned buffer. Assuming that this fits into
++ * a single cache-line, then the variable memory accesses don't actually affect
++ * the timing. This has been tested to be true on Intel amd64 chips.
++ */
++void ssl3_cbc_copy_mac(unsigned char* out,
++		       const SSL3_RECORD *rec,
++		       unsigned md_size)
++	{
++#if defined(CBC_MAC_ROTATE_IN_PLACE)
++	unsigned char rotated_mac_buf[EVP_MAX_MD_SIZE*2];
++	unsigned char *rotated_mac;
++#else
++	unsigned char rotated_mac[EVP_MAX_MD_SIZE];
++#endif
++
++	/* mac_end is the index of |rec->data| just after the end of the MAC. */
++	unsigned mac_end = rec->length;
++	unsigned mac_start = mac_end - md_size;
++	/* scan_start contains the number of bytes that we can ignore because
++	 * the MAC's position can only vary by 255 bytes. */
++	unsigned scan_start = 0;
++	unsigned i, j;
++	unsigned div_spoiler;
++	unsigned rotate_offset;
++
++	OPENSSL_assert(rec->orig_len >= md_size);
++	OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE);
++
++#if defined(CBC_MAC_ROTATE_IN_PLACE)
++	rotated_mac = (unsigned char*) (((intptr_t)(rotated_mac_buf + 64)) & ~63);
++#endif
++
++	/* This information is public so it's safe to branch based on it. */
++	if (rec->orig_len > md_size + 255 + 1)
++		scan_start = rec->orig_len - (md_size + 255 + 1);
++	/* div_spoiler contains a multiple of md_size that is used to cause the
++	 * modulo operation to be constant time. Without this, the time varies
++	 * based on the amount of padding when running on Intel chips at least.
++	 *
++	 * The aim of right-shifting md_size is so that the compiler doesn't
++	 * figure out that it can remove div_spoiler as that would require it
++	 * to prove that md_size is always even, which I hope is beyond it. */
++	div_spoiler = md_size >> 1;
++	div_spoiler <<= (sizeof(div_spoiler)-1)*8;
++	rotate_offset = (div_spoiler + mac_start - scan_start) % md_size;
++
++	memset(rotated_mac, 0, md_size);
++	for (i = scan_start; i < rec->orig_len;)
++		{
++		for (j = 0; j < md_size && i < rec->orig_len; i++, j++)
++			{
++			unsigned char mac_started = constant_time_ge(i, mac_start);
++			unsigned char mac_ended = constant_time_ge(i, mac_end);
++			unsigned char b = 0;
++			b = rec->data[i];
++			rotated_mac[j] |= b & mac_started & ~mac_ended;
++			}
++		}
++
++	/* Now rotate the MAC */
++#if defined(CBC_MAC_ROTATE_IN_PLACE)
++	j = 0;
++	for (i = 0; i < md_size; i++)
++		{
++		unsigned char offset = (div_spoiler + rotate_offset + i) % md_size;
++		out[j++] = rotated_mac[offset];
++		}
++#else
++	memset(out, 0, md_size);
++	for (i = 0; i < md_size; i++)
++		{
++		unsigned char offset = (div_spoiler + md_size - rotate_offset + i) % md_size;
++		for (j = 0; j < md_size; j++)
++			out[j] |= rotated_mac[i] & constant_time_eq_8(j, offset);
++		}
++#endif
++	}
++
++/* These functions serialize the state of a hash and thus perform the standard
++ * "final" operation without adding the padding and length that such a function
++ * typically does. */
++static void tls1_md5_final_raw(void* ctx, unsigned char *md_out)
++	{
++	MD5_CTX *md5 = ctx;
++	l2n(md5->A, md_out);
++	l2n(md5->B, md_out);
++	l2n(md5->C, md_out);
++	l2n(md5->D, md_out);
++	}
++
++static void tls1_sha1_final_raw(void* ctx, unsigned char *md_out)
++	{
++	SHA_CTX *sha1 = ctx;
++	l2n(sha1->h0, md_out);
++	l2n(sha1->h1, md_out);
++	l2n(sha1->h2, md_out);
++	l2n(sha1->h3, md_out);
++	l2n(sha1->h4, md_out);
++	}
++
++static void tls1_sha256_final_raw(void* ctx, unsigned char *md_out)
++	{
++	SHA256_CTX *sha256 = ctx;
++	unsigned i;
++
++	for (i = 0; i < 8; i++)
++		{
++		l2n(sha256->h[i], md_out);
++		}
++	}
++
++static void tls1_sha512_final_raw(void* ctx, unsigned char *md_out)
++	{
++	SHA512_CTX *sha512 = ctx;
++	unsigned i;
++
++	for (i = 0; i < 8; i++)
++		{
++		l2n8(sha512->h[i], md_out);
++		}
++	}
++
++/* ssl3_cbc_record_digest_supported returns 1 iff |ctx| uses a hash function
++ * which ssl3_cbc_digest_record supports. */
++char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
++	{
++	switch (ctx->digest->type)
++		{
++		case NID_md5:
++		case NID_sha1:
++		case NID_sha224:
++		case NID_sha256:
++		case NID_sha384:
++		case NID_sha512:
++			return 1;
++		default:
++			return 0;
++		}
++	}
++
++/* ssl3_cbc_digest_record computes the MAC of a decrypted, padded SSLv3/TLS
++ * record.
++ *
++ *   ctx: the EVP_MD_CTX from which we take the hash function.
++ *     ssl3_cbc_record_digest_supported must return true for this EVP_MD_CTX.
++ *   md_out: the digest output. At most EVP_MAX_MD_SIZE bytes will be written.
++ *   md_out_size: if non-NULL, the number of output bytes is written here.
++ *   header: the 13-byte, TLS record header.
++ *   data: the record data itself, less any preceeding explicit IV.
++ *   data_plus_mac_size: the secret, reported length of the data and MAC
++ *     once the padding has been removed.
++ *   data_plus_mac_plus_padding_size: the public length of the whole
++ *     record, including padding.
++ *   is_sslv3: non-zero if we are to use SSLv3. Otherwise, TLS.
++ *
++ * On entry: by virtue of having been through one of the remove_padding
++ * functions, above, we know that data_plus_mac_size is large enough to contain
++ * a padding byte and MAC. (If the padding was invalid, it might contain the
++ * padding too. ) */
++void ssl3_cbc_digest_record(
++	const EVP_MD_CTX *ctx,
++	unsigned char* md_out,
++	size_t* md_out_size,
++	const unsigned char header[13],
++	const unsigned char *data,
++	size_t data_plus_mac_size,
++	size_t data_plus_mac_plus_padding_size,
++	const unsigned char *mac_secret,
++	unsigned mac_secret_length,
++	char is_sslv3)
++	{
++	unsigned char md_state[sizeof(SHA512_CTX)];
++	void (*md_final_raw)(void *ctx, unsigned char *md_out);
++	void (*md_transform)(void *ctx, const unsigned char *block);
++	unsigned md_size, md_block_size = 64;
++	unsigned sslv3_pad_length = 40, header_length, variance_blocks,
++		 len, max_mac_bytes, num_blocks,
++		 num_starting_blocks, k, mac_end_offset, c, index_a, index_b;
++	uint64_t bits;
++	unsigned char length_bytes[MAX_HASH_BIT_COUNT_BYTES];
++	/* hmac_pad is the masked HMAC key. */
++	unsigned char hmac_pad[MAX_HASH_BLOCK_SIZE];
++	unsigned char first_block[MAX_HASH_BLOCK_SIZE];
++	unsigned char mac_out[EVP_MAX_MD_SIZE];
++	unsigned i, j, md_out_size_u;
++	EVP_MD_CTX md_ctx;
++	/* mdLengthSize is the number of bytes in the length field that terminates
++	* the hash. */
++	unsigned md_length_size = 8;
++
++	/* This is a, hopefully redundant, check that allows us to forget about
++	 * many possible overflows later in this function. */
++	OPENSSL_assert(data_plus_mac_plus_padding_size < 1024*1024);
++
++	switch (ctx->digest->type)
++		{
++		case NID_md5:
++			MD5_Init((MD5_CTX*)md_state);
++			md_final_raw = tls1_md5_final_raw;
++			md_transform = (void(*)(void *ctx, const unsigned char *block)) MD5_Transform;
++			md_size = 16;
++			sslv3_pad_length = 48;
++			break;
++		case NID_sha1:
++			SHA1_Init((SHA_CTX*)md_state);
++			md_final_raw = tls1_sha1_final_raw;
++			md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA1_Transform;
++			md_size = 20;
++			break;
++		case NID_sha224:
++			SHA224_Init((SHA256_CTX*)md_state);
++			md_final_raw = tls1_sha256_final_raw;
++			md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA256_Transform;
++			md_size = 224/8;
++			break;
++		case NID_sha256:
++			SHA256_Init((SHA256_CTX*)md_state);
++			md_final_raw = tls1_sha256_final_raw;
++			md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA256_Transform;
++			md_size = 32;
++			break;
++		case NID_sha384:
++			SHA384_Init((SHA512_CTX*)md_state);
++			md_final_raw = tls1_sha512_final_raw;
++			md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA512_Transform;
++			md_size = 384/8;
++			md_block_size = 128;
++			md_length_size = 16;
++			break;
++		case NID_sha512:
++			SHA512_Init((SHA512_CTX*)md_state);
++			md_final_raw = tls1_sha512_final_raw;
++			md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA512_Transform;
++			md_size = 64;
++			md_block_size = 128;
++			md_length_size = 16;
++			break;
++		default:
++			/* ssl3_cbc_record_digest_supported should have been
++			 * called first to check that the hash function is
++			 * supported. */
++			OPENSSL_assert(0);
++			if (md_out_size)
++				*md_out_size = -1;
++			return;
++		}
++
++	OPENSSL_assert(md_length_size <= MAX_HASH_BIT_COUNT_BYTES);
++	OPENSSL_assert(md_block_size <= MAX_HASH_BLOCK_SIZE);
++	OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE);
++
++	header_length = 13;
++	if (is_sslv3)
++		{
++		header_length =
++			mac_secret_length +
++			sslv3_pad_length +
++			8 /* sequence number */ +
++			1 /* record type */ +
++			2 /* record length */;
++		}
++
++	/* variance_blocks is the number of blocks of the hash that we have to
++	 * calculate in constant time because they could be altered by the
++	 * padding value.
++	 *
++	 * In SSLv3, the padding must be minimal so the end of the plaintext
++	 * varies by, at most, 15+20 = 35 bytes. (We conservatively assume that
++	 * the MAC size varies from 0..20 bytes.) In case the 9 bytes of hash
++	 * termination (0x80 + 64-bit length) don't fit in the final block, we
++	 * say that the final two blocks can vary based on the padding.
++	 *
++	 * TLSv1 has MACs up to 48 bytes long (SHA-384) and the padding is not
++	 * required to be minimal. Therefore we say that the final six blocks
++	 * can vary based on the padding.
++	 *
++	 * Later in the function, if the message is short and there obviously
++	 * cannot be this many blocks then variance_blocks can be reduced. */
++	variance_blocks = is_sslv3 ? 2 : 6;
++	/* From now on we're dealing with the MAC, which conceptually has 13
++	 * bytes of `header' before the start of the data (TLS) or 71/75 bytes
++	 * (SSLv3) */
++	len = data_plus_mac_plus_padding_size + header_length;
++	/* max_mac_bytes contains the maximum bytes of bytes in the MAC, including
++	* |header|, assuming that there's no padding. */
++	max_mac_bytes = len - md_size - 1;
++	/* num_blocks is the maximum number of hash blocks. */
++	num_blocks = (max_mac_bytes + 1 + md_length_size + md_block_size - 1) / md_block_size;
++	/* In order to calculate the MAC in constant time we have to handle
++	 * the final blocks specially because the padding value could cause the
++	 * end to appear somewhere in the final |variance_blocks| blocks and we
++	 * can't leak where. However, |num_starting_blocks| worth of data can
++	 * be hashed right away because no padding value can affect whether
++	 * they are plaintext. */
++	num_starting_blocks = 0;
++	/* k is the starting byte offset into the conceptual header||data where
++	 * we start processing. */
++	k = 0;
++	/* mac_end_offset is the index just past the end of the data to be
++	 * MACed. */
++	mac_end_offset = data_plus_mac_size + header_length - md_size;
++	/* c is the index of the 0x80 byte in the final hash block that
++	 * contains application data. */
++	c = mac_end_offset % md_block_size;
++	/* index_a is the hash block number that contains the 0x80 terminating
++	 * value. */
++	index_a = mac_end_offset / md_block_size;
++	/* index_b is the hash block number that contains the 64-bit hash
++	 * length, in bits. */
++	index_b = (mac_end_offset + md_length_size) / md_block_size;
++	/* bits is the hash-length in bits. It includes the additional hash
++	 * block for the masked HMAC key, or whole of |header| in the case of
++	 * SSLv3. */
++
++	/* For SSLv3, if we're going to have any starting blocks then we need
++	 * at least two because the header is larger than a single block. */
++	if (num_blocks > variance_blocks + (is_sslv3 ? 1 : 0))
++		{
++		num_starting_blocks = num_blocks - variance_blocks;
++		k = md_block_size*num_starting_blocks;
++		}
++
++	bits = 8*mac_end_offset;
++	if (!is_sslv3)
++		{
++		/* Compute the initial HMAC block. For SSLv3, the padding and
++		 * secret bytes are included in |header| because they take more
++		 * than a single block. */
++		bits += 8*md_block_size;
++		memset(hmac_pad, 0, md_block_size);
++		OPENSSL_assert(mac_secret_length <= sizeof(hmac_pad));
++		memcpy(hmac_pad, mac_secret, mac_secret_length);
++		for (i = 0; i < md_block_size; i++)
++			hmac_pad[i] ^= 0x36;
++
++		md_transform(md_state, hmac_pad);
++		}
++
++	j = 0;
++	if (md_length_size == 16)
++		{
++		memset(length_bytes, 0, 8);
++		j = 8;
++		}
++	for (i = 0; i < 8; i++)
++		length_bytes[i+j] = bits >> (8*(7-i));
++
++	if (k > 0)
++		{
++		if (is_sslv3)
++			{
++			/* The SSLv3 header is larger than a single block.
++			 * overhang is the number of bytes beyond a single
++			 * block that the header consumes: either 7 bytes
++			 * (SHA1) or 11 bytes (MD5). */
++			unsigned overhang = header_length-md_block_size;
++			md_transform(md_state, header);
++			memcpy(first_block, header + md_block_size, overhang);
++			memcpy(first_block + overhang, data, md_block_size-overhang);
++			md_transform(md_state, first_block);
++			for (i = 1; i < k/md_block_size - 1; i++)
++				md_transform(md_state, data + md_block_size*i - overhang);
++			}
++		else
++			{
++			/* k is a multiple of md_block_size. */
++			memcpy(first_block, header, 13);
++			memcpy(first_block+13, data, md_block_size-13);
++			md_transform(md_state, first_block);
++			for (i = 1; i < k/md_block_size; i++)
++				md_transform(md_state, data + md_block_size*i - 13);
++			}
++		}
++
++	memset(mac_out, 0, sizeof(mac_out));
++
++	/* We now process the final hash blocks. For each block, we construct
++	 * it in constant time. If the |i==index_a| then we'll include the 0x80
++	 * bytes and zero pad etc. For each block we selectively copy it, in
++	 * constant time, to |mac_out|. */
++	for (i = num_starting_blocks; i <= num_starting_blocks+variance_blocks; i++)
++		{
++		unsigned char block[MAX_HASH_BLOCK_SIZE];
++		unsigned char is_block_a = constant_time_eq_8(i, index_a);
++		unsigned char is_block_b = constant_time_eq_8(i, index_b);
++		for (j = 0; j < md_block_size; j++)
++			{
++			unsigned char b = 0, is_past_c, is_past_cp1;
++			if (k < header_length)
++				b = header[k];
++			else if (k < data_plus_mac_plus_padding_size + header_length)
++				b = data[k-header_length];
++			k++;
++
++			is_past_c = is_block_a & constant_time_ge(j, c);
++			is_past_cp1 = is_block_a & constant_time_ge(j, c+1);
++			/* If this is the block containing the end of the
++			 * application data, and we are at the offset for the
++			 * 0x80 value, then overwrite b with 0x80. */
++			b = (b&~is_past_c) | (0x80&is_past_c);
++			/* If this the the block containing the end of the
++			 * application data and we're past the 0x80 value then
++			 * just write zero. */
++			b = b&~is_past_cp1;
++			/* If this is index_b (the final block), but not
++			 * index_a (the end of the data), then the 64-bit
++			 * length didn't fit into index_a and we're having to
++			 * add an extra block of zeros. */
++			b &= ~is_block_b | is_block_a;
++
++			/* The final bytes of one of the blocks contains the
++			 * length. */
++			if (j >= md_block_size - md_length_size)
++				{
++				/* If this is index_b, write a length byte. */
++				b = (b&~is_block_b) | (is_block_b&length_bytes[j-(md_block_size-md_length_size)]);
++				}
++			block[j] = b;
++			}
++
++		md_transform(md_state, block);
++		md_final_raw(md_state, block);
++		/* If this is index_b, copy the hash value to |mac_out|. */
++		for (j = 0; j < md_size; j++)
++			mac_out[j] |= block[j]&is_block_b;
++		}
++
++	EVP_MD_CTX_init(&md_ctx);
++	EVP_DigestInit_ex(&md_ctx, ctx->digest, NULL /* engine */);
++	if (is_sslv3)
++		{
++		/* We repurpose |hmac_pad| to contain the SSLv3 pad2 block. */
++		memset(hmac_pad, 0x5c, sslv3_pad_length);
++
++		EVP_DigestUpdate(&md_ctx, mac_secret, mac_secret_length);
++		EVP_DigestUpdate(&md_ctx, hmac_pad, sslv3_pad_length);
++		EVP_DigestUpdate(&md_ctx, mac_out, md_size);
++		}
++	else
++		{
++		/* Complete the HMAC in the standard manner. */
++		for (i = 0; i < md_block_size; i++)
++			hmac_pad[i] ^= 0x6a;
++
++		EVP_DigestUpdate(&md_ctx, hmac_pad, md_block_size);
++		EVP_DigestUpdate(&md_ctx, mac_out, md_size);
++		}
++	EVP_DigestFinal(&md_ctx, md_out, &md_out_size_u);
++	if (md_out_size)
++		*md_out_size = md_out_size_u;
++	EVP_MD_CTX_cleanup(&md_ctx);
++	}
+diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
+index c5df2cb..a0eac77 100644
+--- a/ssl/s3_enc.c
++++ b/ssl/s3_enc.c
+@@ -466,12 +466,21 @@ void ssl3_cleanup_key_block(SSL *s)
+ 	s->s3->tmp.key_block_length=0;
+ 	}
+ 
++/* ssl3_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
++ *
++ * Returns:
++ *   0: (in non-constant time) if the record is publically invalid (i.e. too
++ *       short etc).
++ *   1: if the record's padding is valid / the encryption was successful.
++ *   -1: if the record's padding is invalid or, if sending, an internal error
++ *       occured.
++ */
+ int ssl3_enc(SSL *s, int send)
+ 	{
+ 	SSL3_RECORD *rec;
+ 	EVP_CIPHER_CTX *ds;
+ 	unsigned long l;
+-	int bs,i;
++	int bs,i,mac_size=0;
+ 	const EVP_CIPHER *enc;
+ 
+ 	if (send)
+@@ -522,32 +531,16 @@ int ssl3_enc(SSL *s, int send)
+ 		if (!send)
+ 			{
+ 			if (l == 0 || l%bs != 0)
+-				{
+-				SSLerr(SSL_F_SSL3_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
+-				ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED);
+ 				return 0;
+-				}
+ 			/* otherwise, rec->length >= bs */
+ 			}
+ 		
+ 		EVP_Cipher(ds,rec->data,rec->input,l);
+ 
++		if (EVP_MD_CTX_md(s->read_hash) != NULL)
++			mac_size = EVP_MD_CTX_size(s->read_hash);
+ 		if ((bs != 1) && !send)
+-			{
+-			i=rec->data[l-1]+1;
+-			/* SSL 3.0 bounds the number of padding bytes by the block size;
+-			 * padding bytes (except the last one) are arbitrary */
+-			if (i > bs)
+-				{
+-				/* Incorrect padding. SSLerr() and ssl3_alert are done
+-				 * by caller: we don't want to reveal whether this is
+-				 * a decryption error or a MAC verification failure
+-				 * (see http://www.openssl.org/~bodo/tls-cbc.txt) */
+-				return -1;
+-				}
+-			/* now i <= bs <= rec->length */
+-			rec->length-=i;
+-			}
++			return ssl3_cbc_remove_padding(s, rec, bs, mac_size);
+ 		}
+ 	return(1);
+ 	}
+@@ -716,7 +709,7 @@ int n_ssl3_mac(SSL *ssl, unsigned char *md, int send)
+ 	EVP_MD_CTX md_ctx;
+ 	const EVP_MD_CTX *hash;
+ 	unsigned char *p,rec_char;
+-	unsigned int md_size;
++	size_t md_size;
+ 	int npad;
+ 	int t;
+ 
+@@ -741,28 +734,68 @@ int n_ssl3_mac(SSL *ssl, unsigned char *md, int send)
+ 	md_size=t;
+ 	npad=(48/md_size)*md_size;
+ 
+-	/* Chop the digest off the end :-) */
+-	EVP_MD_CTX_init(&md_ctx);
+-
+-	EVP_MD_CTX_copy_ex( &md_ctx,hash);
+-	EVP_DigestUpdate(&md_ctx,mac_sec,md_size);
+-	EVP_DigestUpdate(&md_ctx,ssl3_pad_1,npad);
+-	EVP_DigestUpdate(&md_ctx,seq,8);
+-	rec_char=rec->type;
+-	EVP_DigestUpdate(&md_ctx,&rec_char,1);
+-	p=md;
+-	s2n(rec->length,p);
+-	EVP_DigestUpdate(&md_ctx,md,2);
+-	EVP_DigestUpdate(&md_ctx,rec->input,rec->length);
+-	EVP_DigestFinal_ex( &md_ctx,md,NULL);
+-
+-	EVP_MD_CTX_copy_ex( &md_ctx,hash);
+-	EVP_DigestUpdate(&md_ctx,mac_sec,md_size);
+-	EVP_DigestUpdate(&md_ctx,ssl3_pad_2,npad);
+-	EVP_DigestUpdate(&md_ctx,md,md_size);
+-	EVP_DigestFinal_ex( &md_ctx,md,&md_size);
+-
+-	EVP_MD_CTX_cleanup(&md_ctx);
++	if (!send &&
++	    EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
++	    ssl3_cbc_record_digest_supported(hash))
++		{
++		/* This is a CBC-encrypted record. We must avoid leaking any
++		 * timing-side channel information about how many blocks of
++		 * data we are hashing because that gives an attacker a
++		 * timing-oracle. */
++
++		/* npad is, at most, 48 bytes and that's with MD5:
++		 *   16 + 48 + 8 (sequence bytes) + 1 + 2 = 75.
++		 *
++		 * With SHA-1 (the largest hash speced for SSLv3) the hash size
++		 * goes up 4, but npad goes down by 8, resulting in a smaller
++		 * total size. */
++		unsigned char header[75];
++		unsigned j = 0;
++		memcpy(header+j, mac_sec, md_size);
++		j += md_size;
++		memcpy(header+j, ssl3_pad_1, npad);
++		j += npad;
++		memcpy(header+j, seq, 8);
++		j += 8;
++		header[j++] = rec->type;
++		header[j++] = rec->length >> 8;
++		header[j++] = rec->length & 0xff;
++
++		ssl3_cbc_digest_record(
++			hash,
++			md, &md_size,
++			header, rec->input,
++			rec->length + md_size, rec->orig_len,
++			mac_sec, md_size,
++			1 /* is SSLv3 */);
++		}
++	else
++		{
++		unsigned int md_size_u;
++		/* Chop the digest off the end :-) */
++		EVP_MD_CTX_init(&md_ctx);
++
++		EVP_MD_CTX_copy_ex( &md_ctx,hash);
++		EVP_DigestUpdate(&md_ctx,mac_sec,md_size);
++		EVP_DigestUpdate(&md_ctx,ssl3_pad_1,npad);
++		EVP_DigestUpdate(&md_ctx,seq,8);
++		rec_char=rec->type;
++		EVP_DigestUpdate(&md_ctx,&rec_char,1);
++		p=md;
++		s2n(rec->length,p);
++		EVP_DigestUpdate(&md_ctx,md,2);
++		EVP_DigestUpdate(&md_ctx,rec->input,rec->length);
++		EVP_DigestFinal_ex( &md_ctx,md,NULL);
++
++		EVP_MD_CTX_copy_ex( &md_ctx,hash);
++		EVP_DigestUpdate(&md_ctx,mac_sec,md_size);
++		EVP_DigestUpdate(&md_ctx,ssl3_pad_2,npad);
++		EVP_DigestUpdate(&md_ctx,md,md_size);
++		EVP_DigestFinal_ex( &md_ctx,md,&md_size_u);
++		md_size = md_size_u;
++
++		EVP_MD_CTX_cleanup(&md_ctx);
++	}
+ 
+ 	ssl3_record_sequence_update(seq);
+ 	return(md_size);
+diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
+index 3e11140..dba6653 100644
+--- a/ssl/s3_pkt.c
++++ b/ssl/s3_pkt.c
+@@ -290,11 +290,8 @@ static int ssl3_get_record(SSL *s)
+ 	unsigned char *p;
+ 	unsigned char md[EVP_MAX_MD_SIZE];
+ 	short version;
+-	int mac_size;
+-	int clear=0;
++	unsigned mac_size;
+ 	size_t extra;
+-	int decryption_failed_or_bad_record_mac = 0;
+-	unsigned char *mac = NULL;
+ 
+ 	rr= &(s->s3->rrec);
+ 	sess=s->session;
+@@ -401,19 +398,18 @@ fprintf(stderr, "Record type=%d, Length=%d\n", rr->type, rr->length);
+ 
+ 	/* decrypt in place in 'rr->input' */
+ 	rr->data=rr->input;
++	rr->orig_len=rr->length;
+ 
+ 	enc_err = s->method->ssl3_enc->enc(s,0);
+-	if (enc_err <= 0)
++	/* enc_err is:
++	 *    0: (in non-constant time) if the record is publically invalid.
++	 *    1: if the padding is valid
++	 *    -1: if the padding is invalid */
++	if (enc_err == 0)
+ 		{
+-		if (enc_err == 0)
+-			/* SSLerr() and ssl3_send_alert() have been called */
+-			goto err;
+-
+-		/* Otherwise enc_err == -1, which indicates bad padding
+-		 * (rec->length has not been changed in this case).
+-		 * To minimize information leaked via timing, we will perform
+-		 * the MAC computation anyway. */
+-		decryption_failed_or_bad_record_mac = 1;
++		al=SSL_AD_DECRYPTION_FAILED;
++		SSLerr(SSL_F_TLS1_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
++		goto f_err;
+ 		}
+ 
+ #ifdef TLS_DEBUG
+@@ -423,53 +419,59 @@ printf("\n");
+ #endif
+ 
+ 	/* r->length is now the compressed data plus mac */
+-	if (	(sess == NULL) ||
+-		(s->enc_read_ctx == NULL) ||
+-		(EVP_MD_CTX_md(s->read_hash) == NULL))
+-		clear=1;
+-
+-	if (!clear)
++	if ((sess != NULL) &&
++	    (s->enc_read_ctx != NULL) &&
++	    (EVP_MD_CTX_md(s->read_hash) != NULL))
+ 		{
+-		/* !clear => s->read_hash != NULL => mac_size != -1 */
++		/* s->read_hash != NULL => mac_size != -1 */
++		unsigned char *mac = NULL;
++		unsigned char mac_tmp[EVP_MAX_MD_SIZE];
+ 		mac_size=EVP_MD_CTX_size(s->read_hash);
+-		OPENSSL_assert(mac_size >= 0);
++		OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);
+ 
+-		if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra+mac_size)
++		/* orig_len is the length of the record before any padding was
++		 * removed. This is public information, as is the MAC in use,
++		 * therefore we can safely process the record in a different
++		 * amount of time if it's too short to possibly contain a MAC.
++		 */
++		if (rr->orig_len < mac_size ||
++		    /* CBC records must have a padding length byte too. */
++		    (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
++		     rr->orig_len < mac_size+1))
+ 			{
+-#if 0 /* OK only for stream ciphers (then rr->length is visible from ciphertext anyway) */
+-			al=SSL_AD_RECORD_OVERFLOW;
+-			SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);
++			al=SSL_AD_DECODE_ERROR;
++			SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT);
+ 			goto f_err;
+-#else
+-			decryption_failed_or_bad_record_mac = 1;
+-#endif			
+ 			}
+-		/* check the MAC for rr->input (it's in mac_size bytes at the tail) */
+-		if (rr->length >= (unsigned int)mac_size)
++
++		if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE)
+ 			{
++			/* We update the length so that the TLS header bytes
++			 * can be constructed correctly but we need to extract
++			 * the MAC in constant time from within the record,
++			 * without leaking the contents of the padding bytes.
++			 * */
++			mac = mac_tmp;
++			ssl3_cbc_copy_mac(mac_tmp, rr, mac_size);
+ 			rr->length -= mac_size;
+-			mac = &rr->data[rr->length];
+ 			}
+ 		else
+ 			{
+-			/* record (minus padding) is too short to contain a MAC */
+-#if 0 /* OK only for stream ciphers */
+-			al=SSL_AD_DECODE_ERROR;
+-			SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT);
+-			goto f_err;
+-#else
+-			decryption_failed_or_bad_record_mac = 1;
+-			rr->length = 0;
+-#endif
++			/* In this case there's no padding, so |rec->orig_len|
++			 * equals |rec->length| and we checked that there's
++			 * enough bytes for |mac_size| above. */
++			rr->length -= mac_size;
++			mac = &rr->data[rr->length];
+ 			}
+-		i=s->method->ssl3_enc->mac(s,md,0);
++
++		i=s->method->ssl3_enc->mac(s,md,0 /* not send */);
+ 		if (i < 0 || mac == NULL || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0)
+-			{
+-			decryption_failed_or_bad_record_mac = 1;
+-			}
++			enc_err = -1;
++		if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra+mac_size)
++			enc_err = -1;
+ 		}
+ 
+-	if (decryption_failed_or_bad_record_mac)
++	if (enc_err < 0)
+ 		{
+ 		/* A separate 'decryption_failed' alert was introduced with TLS 1.0,
+ 		 * SSL 3.0 only has 'bad_record_mac'.  But unless a decryption
+diff --git a/ssl/ssl3.h b/ssl/ssl3.h
+index 247e88c..87d3e0f 100644
+--- a/ssl/ssl3.h
++++ b/ssl/ssl3.h
+@@ -355,6 +355,10 @@ typedef struct ssl3_record_st
+ /*r */	unsigned char *comp;    /* only used with decompression - malloc()ed */
+ /*r */  unsigned long epoch;    /* epoch number, needed by DTLS1 */
+ /*r */  unsigned char seq_num[8]; /* sequence number, needed by DTLS1 */
++/*rw*/	unsigned int orig_len;  /* How many bytes were available before padding
++				   was removed? This is used to implement the
++				   MAC check in constant time for CBC records.
++				 */
+ 	} SSL3_RECORD;
+ 
+ typedef struct ssl3_buffer_st
+diff --git a/ssl/ssl_algs.c b/ssl/ssl_algs.c
+index d443143..41ccbaa 100644
+--- a/ssl/ssl_algs.c
++++ b/ssl/ssl_algs.c
+@@ -90,11 +90,14 @@ int SSL_library_init(void)
+ 	EVP_add_cipher(EVP_aes_256_cbc());
+ 	EVP_add_cipher(EVP_aes_128_gcm());
+ 	EVP_add_cipher(EVP_aes_256_gcm());
++#if 0 /* Disabled because of timing side-channel leaks. */
+ #if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1)
+ 	EVP_add_cipher(EVP_aes_128_cbc_hmac_sha1());
+ 	EVP_add_cipher(EVP_aes_256_cbc_hmac_sha1());
+ #endif
+ #endif
++
++#endif
+ #ifndef OPENSSL_NO_CAMELLIA
+ 	EVP_add_cipher(EVP_camellia_128_cbc());
+ 	EVP_add_cipher(EVP_camellia_256_cbc());
+diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
+index 0572e10..dd8388c 100644
+--- a/ssl/ssl_locl.h
++++ b/ssl/ssl_locl.h
+@@ -215,6 +215,15 @@
+ 			 *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
+ 			 *((c)++)=(unsigned char)(((l)    )&0xff))
+ 
++#define l2n8(l,c)	(*((c)++)=(unsigned char)(((l)>>56)&0xff), \
++			 *((c)++)=(unsigned char)(((l)>>48)&0xff), \
++			 *((c)++)=(unsigned char)(((l)>>40)&0xff), \
++			 *((c)++)=(unsigned char)(((l)>>32)&0xff), \
++			 *((c)++)=(unsigned char)(((l)>>24)&0xff), \
++			 *((c)++)=(unsigned char)(((l)>>16)&0xff), \
++			 *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
++			 *((c)++)=(unsigned char)(((l)    )&0xff))
++
+ #define n2l6(c,l)	(l =((BN_ULLONG)(*((c)++)))<<40, \
+ 			 l|=((BN_ULLONG)(*((c)++)))<<32, \
+ 			 l|=((BN_ULLONG)(*((c)++)))<<24, \
+@@ -1133,4 +1142,29 @@ int ssl_parse_clienthello_use_srtp_ext(SSL *s, unsigned char *d, int len,int *al
+ int ssl_add_serverhello_use_srtp_ext(SSL *s, unsigned char *p, int *len, int maxlen);
+ int ssl_parse_serverhello_use_srtp_ext(SSL *s, unsigned char *d, int len,int *al);
+ 
++/* s3_cbc.c */
++void ssl3_cbc_copy_mac(unsigned char* out,
++		       const SSL3_RECORD *rec,
++		       unsigned md_size);
++int ssl3_cbc_remove_padding(const SSL* s,
++			    SSL3_RECORD *rec,
++			    unsigned block_size,
++			    unsigned mac_size);
++int tls1_cbc_remove_padding(const SSL* s,
++			    SSL3_RECORD *rec,
++			    unsigned block_size,
++			    unsigned mac_size);
++char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx);
++void ssl3_cbc_digest_record(
++	const EVP_MD_CTX *ctx,
++	unsigned char* md_out,
++	size_t* md_out_size,
++	const unsigned char header[13],
++	const unsigned char *data,
++	size_t data_plus_mac_size,
++	size_t data_plus_mac_plus_padding_size,
++	const unsigned char *mac_secret,
++	unsigned mac_secret_length,
++	char is_sslv3);
++
+ #endif
+diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
+index b37678f..bb46f7f 100644
+--- a/ssl/t1_enc.c
++++ b/ssl/t1_enc.c
+@@ -667,12 +667,21 @@ err:
+ 	return(ret);
+ 	}
+ 
++/* tls1_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
++ *
++ * Returns:
++ *   0: (in non-constant time) if the record is publically invalid (i.e. too
++ *       short etc).
++ *   1: if the record's padding is valid / the encryption was successful.
++ *   -1: if the record's padding/AEAD-authenticator is invalid or, if sending,
++ *       an internal error occured.
++ */
+ int tls1_enc(SSL *s, int send)
+ 	{
+ 	SSL3_RECORD *rec;
+ 	EVP_CIPHER_CTX *ds;
+ 	unsigned long l;
+-	int bs,i,ii,j,k,pad=0;
++	int bs,i,j,k,pad=0,ret,mac_size=0;
+ 	const EVP_CIPHER *enc;
+ 
+ 	if (send)
+@@ -729,11 +738,11 @@ int tls1_enc(SSL *s, int send)
+ 	printf("tls1_enc(%d)\n", send);
+ #endif    /* KSSL_DEBUG */
+ 
+-	if ((s->session == NULL) || (ds == NULL) ||
+-		(enc == NULL))
++	if ((s->session == NULL) || (ds == NULL) || (enc == NULL))
+ 		{
+ 		memmove(rec->data,rec->input,rec->length);
+ 		rec->input=rec->data;
++		ret = 1;
+ 		}
+ 	else
+ 		{
+@@ -797,13 +806,13 @@ int tls1_enc(SSL *s, int send)
+ 
+ #ifdef KSSL_DEBUG
+ 		{
+-                unsigned long ui;
++		unsigned long ui;
+ 		printf("EVP_Cipher(ds=%p,rec->data=%p,rec->input=%p,l=%ld) ==>\n",
+-                        ds,rec->data,rec->input,l);
++			ds,rec->data,rec->input,l);
+ 		printf("\tEVP_CIPHER_CTX: %d buf_len, %d key_len [%d %d], %d iv_len\n",
+-                        ds->buf_len, ds->cipher->key_len,
+-                        DES_KEY_SZ, DES_SCHEDULE_SZ,
+-                        ds->cipher->iv_len);
++			ds->buf_len, ds->cipher->key_len,
++			DES_KEY_SZ, DES_SCHEDULE_SZ,
++			ds->cipher->iv_len);
+ 		printf("\t\tIV: ");
+ 		for (i=0; i<ds->cipher->iv_len; i++) printf("%02X", ds->iv[i]);
+ 		printf("\n");
+@@ -816,13 +825,7 @@ int tls1_enc(SSL *s, int send)
+ 		if (!send)
+ 			{
+ 			if (l == 0 || l%bs != 0)
+-				{
+-				if (s->version >= TLS1_1_VERSION)
+-					return -1;
+-				SSLerr(SSL_F_TLS1_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
+-				ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED);
+ 				return 0;
+-				}
+ 			}
+ 		
+ 		i = EVP_Cipher(ds,rec->data,rec->input,l);
+@@ -839,68 +842,24 @@ int tls1_enc(SSL *s, int send)
+ 
+ #ifdef KSSL_DEBUG
+ 		{
+-                unsigned long i;
+-                printf("\trec->data=");
++		unsigned long i;
++		printf("\trec->data=");
+ 		for (i=0; i<l; i++)
+-                        printf(" %02x", rec->data[i]);  printf("\n");
+-                }
++			printf(" %02x", rec->data[i]);  printf("\n");
++		}
+ #endif	/* KSSL_DEBUG */
+ 
++		ret = 1;
++		if (EVP_MD_CTX_md(s->read_hash) != NULL)
++			mac_size = EVP_MD_CTX_size(s->read_hash);
+ 		if ((bs != 1) && !send)
+-			{
+-			ii=i=rec->data[l-1]; /* padding_length */
+-			i++;
+-			/* NB: if compression is in operation the first packet
+-			 * may not be of even length so the padding bug check
+-			 * cannot be performed. This bug workaround has been
+-			 * around since SSLeay so hopefully it is either fixed
+-			 * now or no buggy implementation supports compression 
+-			 * [steve]
+-			 */
+-			if ( (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG)
+-				&& !s->expand)
+-				{
+-				/* First packet is even in size, so check */
+-				if ((memcmp(s->s3->read_sequence,
+-					"\0\0\0\0\0\0\0\0",8) == 0) && !(ii & 1))
+-					s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;
+-				if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
+-					i--;
+-				}
+-			/* TLS 1.0 does not bound the number of padding bytes by the block size.
+-			 * All of them must have value 'padding_length'. */
+-			if (i > (int)rec->length)
+-				{
+-				/* Incorrect padding. SSLerr() and ssl3_alert are done
+-				 * by caller: we don't want to reveal whether this is
+-				 * a decryption error or a MAC verification failure
+-				 * (see http://www.openssl.org/~bodo/tls-cbc.txt) */
+-				return -1;
+-				}
+-			for (j=(int)(l-i); j<(int)l; j++)
+-				{
+-				if (rec->data[j] != ii)
+-					{
+-					/* Incorrect padding */
+-					return -1;
+-					}
+-				}
+-			rec->length -=i;
+-			if (s->version >= TLS1_1_VERSION
+-				&& EVP_CIPHER_CTX_mode(ds) == EVP_CIPH_CBC_MODE)
+-				{
+-				if (bs > (int)rec->length)
+-					return -1;
+-				rec->data += bs;    /* skip the explicit IV */
+-				rec->input += bs;
+-				rec->length -= bs;
+-				}
+-			}
++			ret = tls1_cbc_remove_padding(s, rec, bs, mac_size);
+ 		if (pad && !send)
+ 			rec->length -= pad;
+ 		}
+-	return(1);
++	return ret;
+ 	}
++
+ int tls1_cert_verify_mac(SSL *s, int md_nid, unsigned char *out)
+ 	{
+ 	unsigned int ret;
+@@ -993,7 +952,7 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send)
+ 	size_t md_size;
+ 	int i;
+ 	EVP_MD_CTX hmac, *mac_ctx;
+-	unsigned char buf[5]; 
++	unsigned char header[13];
+ 	int stream_mac = (send?(ssl->mac_flags & SSL_MAC_FLAG_WRITE_MAC_STREAM):(ssl->mac_flags&SSL_MAC_FLAG_READ_MAC_STREAM));
+ 	int t;
+ 
+@@ -1014,12 +973,6 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send)
+ 	OPENSSL_assert(t >= 0);
+ 	md_size=t;
+ 
+-	buf[0]=rec->type;
+-	buf[1]=(unsigned char)(ssl->version>>8);
+-	buf[2]=(unsigned char)(ssl->version);
+-	buf[3]=rec->length>>8;
+-	buf[4]=rec->length&0xff;
+-
+ 	/* I should fix this up TLS TLS TLS TLS TLS XXXXXXXX */
+ 	if (stream_mac) 
+ 		{
+@@ -1038,17 +991,44 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send)
+ 		s2n(send?ssl->d1->w_epoch:ssl->d1->r_epoch, p);
+ 		memcpy (p,&seq[2],6);
+ 
+-		EVP_DigestSignUpdate(mac_ctx,dtlsseq,8);
++		memcpy(header, dtlsseq, 8);
+ 		}
+ 	else
+-		EVP_DigestSignUpdate(mac_ctx,seq,8);
++		memcpy(header, seq, 8);
+ 
+-	EVP_DigestSignUpdate(mac_ctx,buf,5);
+-	EVP_DigestSignUpdate(mac_ctx,rec->input,rec->length);
+-	t=EVP_DigestSignFinal(mac_ctx,md,&md_size);
+-	OPENSSL_assert(t > 0);
++	header[8]=rec->type;
++	header[9]=(unsigned char)(ssl->version>>8);
++	header[10]=(unsigned char)(ssl->version);
++	header[11]=(rec->length)>>8;
++	header[12]=(rec->length)&0xff;
++
++	if (!send &&
++	    EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
++	    ssl3_cbc_record_digest_supported(mac_ctx))
++		{
++		/* This is a CBC-encrypted record. We must avoid leaking any
++		 * timing-side channel information about how many blocks of
++		 * data we are hashing because that gives an attacker a
++		 * timing-oracle. */
++		ssl3_cbc_digest_record(
++			mac_ctx,
++			md, &md_size,
++			header, rec->input,
++			rec->length + md_size, rec->orig_len,
++			ssl->s3->read_mac_secret,
++			ssl->s3->read_mac_secret_size,
++			0 /* not SSLv3 */);
++		}
++	else
++		{
++		EVP_DigestSignUpdate(mac_ctx,header,sizeof(header));
++		EVP_DigestSignUpdate(mac_ctx,rec->input,rec->length);
++		t=EVP_DigestSignFinal(mac_ctx,md,&md_size);
++		OPENSSL_assert(t > 0);
++		}
+ 		
+-	if (!stream_mac) EVP_MD_CTX_cleanup(&hmac);
++	if (!stream_mac)
++		EVP_MD_CTX_cleanup(&hmac);
+ #ifdef TLS_DEBUG
+ printf("sec=");
+ {unsigned int z; for (z=0; z<md_size; z++) printf("%02X ",mac_sec[z]); printf("\n"); }
+-- 
+1.8.1
+
diff --git a/patches/README b/patches/README
index 17422b1..a1d5313 100644
--- a/patches/README
+++ b/patches/README
@@ -31,6 +31,7 @@ channelid.patch
 Implements TLS Channel ID support as both a client and a server.
 See http://tools.ietf.org/html/draft-balfanz-tls-channelid-00.
 
+
 clang.patch
 
 Fixes two minor compilation errors when building with the Clang compiler.
@@ -42,3 +43,15 @@ Small fix to get rid of unwanted recursive mutex lock in X509_PUBKEY_get.
 See http://cvs.openssl.org/chngview?cn=22568 for upstream patch, and
 https://groups.google.com/d/topic/mailing.openssl.dev/4Z67vaaTChk/discussion
 for the most recent discussion.
+
+
+0001-Add-and-use-a-constant-time-memcmp.patch
+
+constant time memcmp
+
+
+0002-Make-CBC-decoding-constant-time.patch
+
+Make CBC decoding constant time CVE-2013-0169
+
+