/* ssl3_SendPaddingExtension possibly adds an extension which ensures that a
* ClientHello record is either < 256 bytes or is >= 512 bytes. This ensures
* that we don't trigger bugs in F5 products.
*
* This takes an existing extension buffer, |buf|, and the length of the
* remainder of the ClientHello, |prefixLen|. It modifies the extension buffer
* to insert padding at the right place.
*/
SECStatus
ssl_InsertPaddingExtension(const sslSocket *ss, unsigned int prefixLen,
sslBuffer *buf)
{
static unsigned char padding[252] = { 0 };
unsigned int paddingLen;
unsigned int tailLen;
SECStatus rv;
/* Account for the size of the header, the length field of the extensions
* block and the size of the existing extensions. */
paddingLen = ssl_CalculatePaddingExtLen(ss, prefixLen + 2 + buf->len);
if (!paddingLen) {
return SECSuccess;
}
/* Move the tail if there is one. This only happens if we are sending the
* TLS 1.3 PSK extension, which needs to be at the end. */
if (ss->xtnData.lastXtnOffset) {
PORT_Assert(buf->len > ss->xtnData.lastXtnOffset);
tailLen = buf->len - ss->xtnData.lastXtnOffset;
rv = sslBuffer_Grow(buf, buf->len + 4 + paddingLen);
if (rv != SECSuccess) {
return SECFailure;
}
PORT_Memmove(buf->buf + ss->xtnData.lastXtnOffset + 4 + paddingLen,
buf->buf + ss->xtnData.lastXtnOffset,
tailLen);
buf->len = ss->xtnData.lastXtnOffset;
} else {
tailLen = 0;
}
rv = sslBuffer_AppendNumber(buf, ssl_padding_xtn, 2);
if (rv != SECSuccess) {
return SECFailure; /* Code already set. */
}
rv = sslBuffer_AppendVariable(buf, padding, paddingLen, 2);
if (rv != SECSuccess) {
return SECFailure; /* Code already set. */
}
buf->len += tailLen;
return SECSuccess;
}
/*
** Send saved write data. This will flush out data sent prior to a
** complete security handshake. Hopefully there won't be too much of it.
** Returns count of the bytes sent, NOT a SECStatus.
** Caller must hold xmitBufLock
*/
int
ssl_SendSavedWriteData(sslSocket *ss)
{
int rv = 0;
PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) );
if (ss->pendingBuf.len != 0) {
SSL_TRC(5, ("%d: SSL[%d]: sending %d bytes of saved data",
SSL_GETPID(), ss->fd, ss->pendingBuf.len));
rv = ssl_DefSend(ss, ss->pendingBuf.buf, ss->pendingBuf.len, 0);
if (rv < 0) {
return rv;
}
ss->pendingBuf.len -= rv;
if (ss->pendingBuf.len > 0 && rv > 0) {
/* UGH !! This shifts the whole buffer down by copying it */
PORT_Memmove(ss->pendingBuf.buf, ss->pendingBuf.buf + rv,
ss->pendingBuf.len);
}
}
return rv;
}
