Receiving data using deserialized SSLv3 connection fails

[jouho]

Security issue notifications

If you discover a potential security issue in s2n we ask that you notify
AWS Security via our vulnerability reporting page. Please do not create a public github issue.

Problem:

I was writing a test to check if connection serialization works with SSLv3 as part of #5523 and found that while serialization and deserialization works, sending/receiving data using the deserialized connection fails.

Test I wrote:

        /* Sanity check: serialization/deserialization works for SSLv3 connection */
        {
            DEFER_CLEANUP(struct s2n_config *sslv3_config = s2n_config_new(), s2n_config_ptr_free);

            EXPECT_SUCCESS(s2n_config_set_cipher_preferences(sslv3_config, "20140601"));
            EXPECT_SUCCESS(s2n_config_add_cert_chain_and_key_to_store(sslv3_config, chain_and_key));
            EXPECT_SUCCESS(s2n_config_disable_x509_verification(sslv3_config));
            EXPECT_SUCCESS(s2n_config_set_serialization_version(sslv3_config, S2N_SERIALIZED_CONN_V1));

            DEFER_CLEANUP(struct s2n_connection *client_conn = s2n_connection_new(S2N_CLIENT),
                    s2n_connection_ptr_free);
            EXPECT_NOT_NULL(client_conn);
            DEFER_CLEANUP(struct s2n_connection *server_conn = s2n_connection_new(S2N_SERVER),
                    s2n_connection_ptr_free);
            EXPECT_NOT_NULL(server_conn);

            EXPECT_SUCCESS(s2n_connection_set_config(client_conn, sslv3_config));
            EXPECT_SUCCESS(s2n_connection_set_config(server_conn, sslv3_config));
            client_conn->client_protocol_version = S2N_SSLv3;
            server_conn->server_protocol_version = S2N_SSLv3;

            DEFER_CLEANUP(struct s2n_test_io_stuffer_pair io_pair = { 0 }, s2n_io_stuffer_pair_free);
            EXPECT_OK(s2n_io_stuffer_pair_init(&io_pair));
            EXPECT_OK(s2n_connections_set_io_stuffer_pair(client_conn, server_conn, &io_pair));

            EXPECT_SUCCESS(s2n_negotiate_test_server_and_client(server_conn, client_conn));
            EXPECT_EQUAL(s2n_connection_get_actual_protocol_version(server_conn), S2N_SSLv3);

            uint8_t buffer[S2N_SERIALIZED_CONN_TLS12_SIZE] = { 0 };
            EXPECT_SUCCESS(s2n_connection_serialize(server_conn, buffer, sizeof(buffer)));

            DEFER_CLEANUP(struct s2n_connection *new_server_conn = s2n_connection_new(S2N_SERVER),
                    s2n_connection_ptr_free);
            EXPECT_NOT_NULL(new_server_conn);
            EXPECT_SUCCESS(s2n_connection_deserialize(new_server_conn, buffer, sizeof(buffer)));
            EXPECT_EQUAL(new_server_conn->actual_protocol_version, S2N_SSLv3);

            /* Test that the deserialized connection can send and receive data */
            EXPECT_SUCCESS(s2n_stuffer_wipe(&io_pair.client_in));
            EXPECT_SUCCESS(s2n_stuffer_wipe(&io_pair.server_in));
            EXPECT_OK(s2n_connections_set_io_stuffer_pair(client_conn, new_server_conn, &io_pair));
            EXPECT_OK(s2n_send_and_recv_test(new_server_conn, client_conn));
            EXPECT_OK(s2n_send_and_recv_test(client_conn, new_server_conn));
        };

Error:

Running tests...
Test project /home/ubuntu/s2n-tls/build
    Start 64: s2n_connection_serialize_test
1/1 Test #64: s2n_connection_serialize_test ....***Failed   11.05 sec
Running /home/ubuntu/s2n-tls/tests/unit/s2n_connection_serialize_test.c ... NOTE: Some details are omitted, run with S2N_PRINT_STACKTRACE=1 for a verbose backtrace.
See https://github.com/aws/s2n-tls/blob/main/docs/usage-guide
FAILED test 242
s2n_result_is_ok(s2n_send_and_recv_test(new_server_conn, client_conn)) is not true  (/home/ubuntu/s2n-tls/tests/unit/s2n_connection_serialize_test.c:389)
Error Message: 'Bad message encountered'
 Debug String: 'Error encountered in /home/ubuntu/s2n-tls/tls/s2n_record_read_cbc.c:106'
 System Error: Input/output error (5)

Without much digging, it seems s2n_constant_time_equals() is returning -1 and causing s2n_record_read_cbc to fail:

s2n-tls/tls/s2n_cbc.c

Lines 80 to 83 in befcaa7

	/* SSLv3 doesn't specify what the padding should actually be */
	if (conn->actual_protocol_version == S2N_SSLv3) {
	return 0 - mismatches;
	}

Need By Date:

We are currently unaware of customers who's trying to use serialization feature with SSLv3

Solution:

Identify the cause and fix underlying issue. This may also be an issue related to CBC with SSLv3 independent from connection serialization feature.

Requirements / Acceptance Criteria:

The test above should be passing after the

[jmayclin]

Note: instead of fixing this I'd prefer to just document it as unsupported. SSLv3 is a tiny fraction of traffic.