openssl/ssl/d1_pkt.c - Issue 2072073002: Delete bundled copy of OpenSSL and replace with README.

Side by Side Diff: openssl/ssl/d1_pkt.c

Issue 2072073002: Delete bundled copy of OpenSSL and replace with README. (Closed) Base URL: https://chromium.googlesource.com/chromium/deps/openssl@master

Patch Set: Delete bundled copy of OpenSSL and replace with README. Created 4 years, 6 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

OLD	NEW
	(Empty)
1 /* ssl/d1_pkt.c */

2 /*

3 * DTLS implementation written by Nagendra Modadugu

4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.

5 */

6 /* ====================================================================

7 * Copyright (c) 1998-2005 The OpenSSL Project. All rights reserved.

8 *

9 * Redistribution and use in source and binary forms, with or without

10 * modification, are permitted provided that the following conditions

11 * are met:

12 *

13 * 1. Redistributions of source code must retain the above copyright

14 * notice, this list of conditions and the following disclaimer.

15 *

16 * 2. Redistributions in binary form must reproduce the above copyright

17 * notice, this list of conditions and the following disclaimer in

18 * the documentation and/or other materials provided with the

19 * distribution.

20 *

21 * 3. All advertising materials mentioning features or use of this

22 * software must display the following acknowledgment:

23 * "This product includes software developed by the OpenSSL Project

24 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"

25 *

26 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

27 * endorse or promote products derived from this software without

28 * prior written permission. For written permission, please contact

29 * openssl-core@openssl.org.

30 *

31 * 5. Products derived from this software may not be called "OpenSSL"

32 * nor may "OpenSSL" appear in their names without prior written

33 * permission of the OpenSSL Project.

34 *

35 * 6. Redistributions of any form whatsoever must retain the following

36 * acknowledgment:

37 * "This product includes software developed by the OpenSSL Project

38 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"

39 *

40 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

41 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

43 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR

44 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

45 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

46 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

47 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

49 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

50 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

51 * OF THE POSSIBILITY OF SUCH DAMAGE.

52 * ====================================================================

53 *

54 * This product includes cryptographic software written by Eric Young

55 * (eay@cryptsoft.com). This product includes software written by Tim

56 * Hudson (tjh@cryptsoft.com).

57 *

58 */

59 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)

60 * All rights reserved.

61 *

62 * This package is an SSL implementation written

63 * by Eric Young (eay@cryptsoft.com).

64 * The implementation was written so as to conform with Netscapes SSL.

65 *

66 * This library is free for commercial and non-commercial use as long as

67 * the following conditions are aheared to. The following conditions

68 * apply to all code found in this distribution, be it the RC4, RSA,

69 * lhash, DES, etc., code; not just the SSL code. The SSL documentation

70 * included with this distribution is covered by the same copyright terms

71 * except that the holder is Tim Hudson (tjh@cryptsoft.com).

72 *

73 * Copyright remains Eric Young's, and as such any Copyright notices in

74 * the code are not to be removed.

75 * If this package is used in a product, Eric Young should be given attribution

76 * as the author of the parts of the library used.

77 * This can be in the form of a textual message at program startup or

78 * in documentation (online or textual) provided with the package.

79 *

80 * Redistribution and use in source and binary forms, with or without

81 * modification, are permitted provided that the following conditions

82 * are met:

83 * 1. Redistributions of source code must retain the copyright

84 * notice, this list of conditions and the following disclaimer.

85 * 2. Redistributions in binary form must reproduce the above copyright

86 * notice, this list of conditions and the following disclaimer in the

87 * documentation and/or other materials provided with the distribution.

88 * 3. All advertising materials mentioning features or use of this software

89 * must display the following acknowledgement:

90 * "This product includes cryptographic software written by

91 * Eric Young (eay@cryptsoft.com)"

92 * The word 'cryptographic' can be left out if the rouines from the library

93 * being used are not cryptographic related :-).

94 * 4. If you include any Windows specific code (or a derivative thereof) from

95 * the apps directory (application code) you must include an acknowledgement:

96 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"

97 *

98 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND

99 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

100 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

101 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE

102 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

103 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

104 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

105 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

106 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

107 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

108 * SUCH DAMAGE.

109 *

110 * The licence and distribution terms for any publically available version or

111 * derivative of this code cannot be changed. i.e. this code cannot simply be

112 * copied and put under another distribution licence

113 * [including the GNU Public Licence.]

114 */

115

116 #include <stdio.h>

117 #include <errno.h>

118 #define USE_SOCKETS

119 #include "ssl_locl.h"

120 #include <openssl/evp.h>

121 #include <openssl/buffer.h>

122 #include <openssl/pqueue.h>

123 #include <openssl/rand.h>

124

125 /* mod 128 saturating subtract of two 64-bit values in big-endian order */

126 static int satsub64be(const unsigned char v1,const unsigned char v2)

127 { int ret,sat,brw,i;

128

129 if (sizeof(long) == 8) do

130 { const union { long one; char little; } is_endian = {1};

131 long l;

132

133 if (is_endian.little) break;

134 /* not reached on little-endians */

135 /* following test is redundant, because input is

136 * always aligned, but I take no chances... */

137 if (((size_t)v1\|(size_t)v2)&0x7) break;

138

139 l = ((long )v1);

140 l -= ((long )v2);

141 if (l>128) return 128;

142 else if (l<-128) return -128;

143 else return (int)l;

144 } while (0);

145

146 ret = (int)v1[7]-(int)v2[7];

147 sat = 0;

148 brw = ret>>8; /* brw is either 0 or -1 */

149 if (ret & 0x80)

150 { for (i=6;i>=0;i--)

151 { brw += (int)v1[i]-(int)v2[i];

152 sat \|= ~brw;

153 brw >>= 8;

154 }

155 }

156 else

157 { for (i=6;i>=0;i--)

158 { brw += (int)v1[i]-(int)v2[i];

159 sat \|= brw;

160 brw >>= 8;

161 }

162 }

163 brw <<= 8; /* brw is either 0 or -256 */

164

165 if (sat&0xff) return brw \| 0x80;

166 else return brw + (ret&0xFF);

167 }

168

169 static int have_handshake_fragment(SSL s, int type, unsigned char buf,

170 int len, int peek);

171 static int dtls1_record_replay_check(SSL s, DTLS1_BITMAP bitmap);

172 static void dtls1_record_bitmap_update(SSL s, DTLS1_BITMAP bitmap);

173 static DTLS1_BITMAP dtls1_get_bitmap(SSL s, SSL3_RECORD *rr,

174 unsigned int *is_next_epoch);

175 #if 0

176 static int dtls1_record_needs_buffering(SSL s, SSL3_RECORD rr,

177 unsigned short priority, unsigned long offset);

178 #endif

179 static int dtls1_buffer_record(SSL s, record_pqueue q,

180 unsigned char *priority);

181 static int dtls1_process_record(SSL *s);

182

183 /* copy buffered record into SSL structure */

184 static int

185 dtls1_copy_record(SSL s, pitem item)

186 {

187 DTLS1_RECORD_DATA *rdata;

188

189 rdata = (DTLS1_RECORD_DATA *)item->data;

190

191 if (s->s3->rbuf.buf != NULL)

192 OPENSSL_free(s->s3->rbuf.buf);

193

194 s->packet = rdata->packet;

195 s->packet_length = rdata->packet_length;

196 memcpy(&(s->s3->rbuf), &(rdata->rbuf), sizeof(SSL3_BUFFER));

197 memcpy(&(s->s3->rrec), &(rdata->rrec), sizeof(SSL3_RECORD));

198

199 /* Set proper sequence number for mac calculation */

200 memcpy(&(s->s3->read_sequence[2]), &(rdata->packet[5]), 6);

201

202 return(1);

203 }

204

205

206 static int

207 dtls1_buffer_record(SSL s, record_pqueue queue, unsigned char *priority)

208 {

209 DTLS1_RECORD_DATA *rdata;

210 pitem *item;

211

212 /* Limit the size of the queue to prevent DOS attacks */

213 if (pqueue_size(queue->q) >= 100)

214 return 0;

215

216 rdata = OPENSSL_malloc(sizeof(DTLS1_RECORD_DATA));

217 item = pitem_new(priority, rdata);

218 if (rdata == NULL \|\| item == NULL)

219 {

220 if (rdata != NULL) OPENSSL_free(rdata);

221 if (item != NULL) pitem_free(item);

222

223 SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);

224 return(0);

225 }

226

227 rdata->packet = s->packet;

228 rdata->packet_length = s->packet_length;

229 memcpy(&(rdata->rbuf), &(s->s3->rbuf), sizeof(SSL3_BUFFER));

230 memcpy(&(rdata->rrec), &(s->s3->rrec), sizeof(SSL3_RECORD));

231

232 item->data = rdata;

233

234 #ifndef OPENSSL_NO_SCTP

235 /* Store bio_dgram_sctp_rcvinfo struct */

236 if (BIO_dgram_is_sctp(SSL_get_rbio(s)) &&

237 (s->state == SSL3_ST_SR_FINISHED_A \|\| s->state == SSL3_ST_CR_FINISHE D_A)) {

238 BIO_ctrl(SSL_get_rbio(s), BIO_CTRL_DGRAM_SCTP_GET_RCVINFO, sizeo f(rdata->recordinfo), &rdata->recordinfo);

239 }

240 #endif

241

242 s->packet = NULL;

243 s->packet_length = 0;

244 memset(&(s->s3->rbuf), 0, sizeof(SSL3_BUFFER));

245 memset(&(s->s3->rrec), 0, sizeof(SSL3_RECORD));

246

247 if (!ssl3_setup_buffers(s))

248 {

249 SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);

250 OPENSSL_free(rdata);

251 pitem_free(item);

252 return(0);

253 }

254

255 /* insert should not fail, since duplicates are dropped */

256 if (pqueue_insert(queue->q, item) == NULL)

257 {

258 OPENSSL_free(rdata);

259 pitem_free(item);

260 return(0);

261 }

262

263 return(1);

264 }

265

266

267 static int

268 dtls1_retrieve_buffered_record(SSL s, record_pqueue queue)

269 {

270 pitem *item;

271

272 item = pqueue_pop(queue->q);

273 if (item)

274 {

275 dtls1_copy_record(s, item);

276

277 OPENSSL_free(item->data);

278 pitem_free(item);

279

280 return(1);

281 }

282

283 return(0);

284 }

285

286

287 /* retrieve a buffered record that belongs to the new epoch, i.e., not processed

288 * yet */

289 #define dtls1_get_unprocessed_record(s) \

290 dtls1_retrieve_buffered_record((s), \

291 &((s)->d1->unprocessed_rcds))

292

293 /* retrieve a buffered record that belongs to the current epoch, ie, processed * /

294 #define dtls1_get_processed_record(s) \

295 dtls1_retrieve_buffered_record((s), \

296 &((s)->d1->processed_rcds))

297

298 static int

299 dtls1_process_buffered_records(SSL *s)

300 {

301 pitem *item;

302

303 item = pqueue_peek(s->d1->unprocessed_rcds.q);

304 if (item)

305 {

306 /* Check if epoch is current. */

307 if (s->d1->unprocessed_rcds.epoch != s->d1->r_epoch)

308 return(1); /* Nothing to do. */

309

310 /* Process all the records. */

311 while (pqueue_peek(s->d1->unprocessed_rcds.q))

312 {

313 dtls1_get_unprocessed_record(s);

314 if ( ! dtls1_process_record(s))

315 return(0);

316 dtls1_buffer_record(s, &(s->d1->processed_rcds),

317 s->s3->rrec.seq_num);

318 }

319 }

320

321 /* sync epoch numbers once all the unprocessed records

322 * have been processed */

323 s->d1->processed_rcds.epoch = s->d1->r_epoch;

324 s->d1->unprocessed_rcds.epoch = s->d1->r_epoch + 1;

325

326 return(1);

327 }

328

329

330 #if 0

331

332 static int

333 dtls1_get_buffered_record(SSL *s)

334 {

335 pitem *item;

336 PQ_64BIT priority =

337 (((PQ_64BIT)s->d1->handshake_read_seq) << 32) \|

338 ((PQ_64BIT)s->d1->r_msg_hdr.frag_off);

339

340 if ( ! SSL_in_init(s)) /* if we're not (re)negotiating,

341 nothing buffered */

342 return 0;

343

344

345 item = pqueue_peek(s->d1->rcvd_records);

346 if (item && item->priority == priority)

347 {

348 /* Check if we've received the record of interest. It must be

349 * a handshake record, since data records as passed up without

350 * buffering */

351 DTLS1_RECORD_DATA *rdata;

352 item = pqueue_pop(s->d1->rcvd_records);

353 rdata = (DTLS1_RECORD_DATA *)item->data;

354

355 if (s->s3->rbuf.buf != NULL)

356 OPENSSL_free(s->s3->rbuf.buf);

357

358 s->packet = rdata->packet;

359 s->packet_length = rdata->packet_length;

360 memcpy(&(s->s3->rbuf), &(rdata->rbuf), sizeof(SSL3_BUFFER));

361 memcpy(&(s->s3->rrec), &(rdata->rrec), sizeof(SSL3_RECORD));

362

363 OPENSSL_free(item->data);

364 pitem_free(item);

365

366 /* s->d1->next_expected_seq_num++; */

367 return(1);

368 }

369

370 return 0;

371 }

372

373 #endif

374

375 static int

376 dtls1_process_record(SSL *s)

377 {

378 int i,al;

379 int enc_err;

380 SSL_SESSION *sess;

381 SSL3_RECORD *rr;

382 unsigned int mac_size, orig_len;

383 unsigned char md[EVP_MAX_MD_SIZE];

384

385 rr= &(s->s3->rrec);

386 sess = s->session;

387

388 /* At this point, s->packet_length == SSL3_RT_HEADER_LNGTH + rr->length,

389 * and we have that many bytes in s->packet

390 */

391 rr->input= &(s->packet[DTLS1_RT_HEADER_LENGTH]);

392

393 /* ok, we can now read from 's->packet' data into 'rr'

394 * rr->input points at rr->length bytes, which

395 * need to be copied into rr->data by either

396 * the decryption or by the decompression

397 * When the data is 'copied' into the rr->data buffer,

398 * rr->input will be pointed at the new buffer */

399

400 /* We now have - encrypted [ MAC [ compressed [ plain ] ] ]

401 * rr->length bytes of encrypted compressed stuff. */

402

403 /* check is not needed I believe */

404 if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH)

405 {

406 al=SSL_AD_RECORD_OVERFLOW;

407 SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_ENCRYPTED_LENGTH_TOO_LON G);

408 goto f_err;

409 }

410

411 /* decrypt in place in 'rr->input' */

412 rr->data=rr->input;

413

414 enc_err = s->method->ssl3_enc->enc(s,0);

415 /* enc_err is:

416 * 0: (in non-constant time) if the record is publically invalid.

417 * 1: if the padding is valid

418 * -1: if the padding is invalid */

419 if (enc_err == 0)

420 {

421 /* For DTLS we simply ignore bad packets. */

422 rr->length = 0;

423 s->packet_length = 0;

424 goto err;

425 }

426

427 #ifdef TLS_DEBUG

428 printf("dec %d\n",rr->length);

429 { unsigned int z; for (z=0; z<rr->length; z++) printf("%02X%c",rr->data[z],((z+1 )%16)?' ':'\n'); }

430 printf("\n");

431 #endif

432

433 /* r->length is now the compressed data plus mac */

434 if ((sess != NULL) &&

435 (s->enc_read_ctx != NULL) &&

436 (EVP_MD_CTX_md(s->read_hash) != NULL))

437 {

438 /* s->read_hash != NULL => mac_size != -1 */

439 unsigned char *mac = NULL;

440 unsigned char mac_tmp[EVP_MAX_MD_SIZE];

441 mac_size=EVP_MD_CTX_size(s->read_hash);

442 OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);

443

444 /* kludge: _cbc_remove_padding passes padding length in rr->typ e /

445 orig_len = rr->length+((unsigned int)rr->type>>8);

446

447 /* orig_len is the length of the record before any padding was

448 * removed. This is public information, as is the MAC in use,

449 * therefore we can safely process the record in a different

450 * amount of time if it's too short to possibly contain a MAC.

451 */

452 if (orig_len < mac_size \|\|

453 /* CBC records must have a padding length byte too. */

454 (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE & &

455 orig_len < mac_size+1))

456 {

457 al=SSL_AD_DECODE_ERROR;

458 SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_LENGTH_TOO_SHORT );

459 goto f_err;

460 }

461

462 if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE)

463 {

464 /* We update the length so that the TLS header bytes

465 * can be constructed correctly but we need to extract

466 * the MAC in constant time from within the record,

467 * without leaking the contents of the padding bytes.

468 * */

469 mac = mac_tmp;

470 ssl3_cbc_copy_mac(mac_tmp, rr, mac_size, orig_len);

471 rr->length -= mac_size;

472 }

473 else

474 {

475 /* In this case there's no padding, so \|orig_len\|

476 * equals \|rec->length\| and we checked that there's

477 * enough bytes for \|mac_size\| above. */

478 rr->length -= mac_size;

479 mac = &rr->data[rr->length];

480 }

481

482 i=s->method->ssl3_enc->mac(s,md,0 /* not send */);

483 if (i < 0 \|\| mac == NULL \|\| CRYPTO_memcmp(md, mac, (size_t)mac_s ize) != 0)

484 enc_err = -1;

485 if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+mac_size)

486 enc_err = -1;

487 }

488

489 if (enc_err < 0)

490 {

491 /* decryption failed, silently discard message */

492 rr->length = 0;

493 s->packet_length = 0;

494 goto err;

495 }

496

497 /* r->length is now just compressed */

498 if (s->expand != NULL)

499 {

500 if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH)

501 {

502 al=SSL_AD_RECORD_OVERFLOW;

503 SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_COMPRESSED_LENGT H_TOO_LONG);

504 goto f_err;

505 }

506 if (!ssl3_do_uncompress(s))

507 {

508 al=SSL_AD_DECOMPRESSION_FAILURE;

509 SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_BAD_DECOMPRESSIO N);

510 goto f_err;

511 }

512 }

513

514 if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH)

515 {

516 al=SSL_AD_RECORD_OVERFLOW;

517 SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_DATA_LENGTH_TOO_LONG);

518 goto f_err;

519 }

520

521 rr->off=0;

522 /* So at this point the following is true

523 * ssl->s3->rrec.type is the type of record

524 * ssl->s3->rrec.length == number of bytes in record

525 * ssl->s3->rrec.off == offset to first valid byte

526 * ssl->s3->rrec.data == where to take bytes from, increment

527 * after use :-).

528 */

529

530 /* we have pulled in a full packet so zero things */

531 s->packet_length=0;

532 dtls1_record_bitmap_update(s, &(s->d1->bitmap));/* Mark receipt of recor d. */

533 return(1);

534

535 f_err:

536 ssl3_send_alert(s,SSL3_AL_FATAL,al);

537 err:

538 return(0);

539 }

540

541

542 /* Call this to get a new input record.

543 * It will return <= 0 if more data is needed, normally due to an error

544 * or non-blocking IO.

545 * When it finishes, one packet has been decoded and can be found in

546 * ssl->s3->rrec.type - is the type of record

547 * ssl->s3->rrec.data, - data

548 * ssl->s3->rrec.length, - number of bytes

549 */

550 /* used only by dtls1_read_bytes */

551 int dtls1_get_record(SSL *s)

552 {

553 int ssl_major,ssl_minor;

554 int i,n;

555 SSL3_RECORD *rr;

556 unsigned char *p = NULL;

557 unsigned short version;

558 DTLS1_BITMAP *bitmap;

559 unsigned int is_next_epoch;

560

561 rr= &(s->s3->rrec);

562

563 /* The epoch may have changed. If so, process all the

564 * pending records. This is a non-blocking operation. */

565 dtls1_process_buffered_records(s);

566

567 /* if we're renegotiating, then there may be buffered records */

568 if (dtls1_get_processed_record(s))

569 return 1;

570

571 /* get something from the wire */

572 again:

573 /* check if we have the header */

574 if ( (s->rstate != SSL_ST_READ_BODY) \|\|

575 (s->packet_length < DTLS1_RT_HEADER_LENGTH))

576 {

577 n=ssl3_read_n(s, DTLS1_RT_HEADER_LENGTH, s->s3->rbuf.len, 0);

578 /* read timeout is handled by dtls1_read_bytes */

579 if (n <= 0) return(n); /* error or non-blocking */

580

581 /* this packet contained a partial record, dump it */

582 if (s->packet_length != DTLS1_RT_HEADER_LENGTH)

583 {

584 s->packet_length = 0;

585 goto again;

586 }

587

588 s->rstate=SSL_ST_READ_BODY;

589

590 p=s->packet;

591

592 /* Pull apart the header into the DTLS1_RECORD */

593 rr->type= *(p++);

594 ssl_major= *(p++);

595 ssl_minor= *(p++);

596 version=(ssl_major<<8)\|ssl_minor;

597

598 /* sequence number is 64 bits, with top 2 bytes = epoch */

599 n2s(p,rr->epoch);

600

601 memcpy(&(s->s3->read_sequence[2]), p, 6);

602 p+=6;

603

604 n2s(p,rr->length);

605

606 /* Lets check version */

607 if (!s->first_packet)

608 {

609 if (version != s->version)

610 {

611 /* unexpected version, silently discard */

612 rr->length = 0;

613 s->packet_length = 0;

614 goto again;

615 }

616 }

617

618 if ((version & 0xff00) != (s->version & 0xff00))

619 {

620 /* wrong version, silently discard record */

621 rr->length = 0;

622 s->packet_length = 0;

623 goto again;

624 }

625

626 if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH)

627 {

628 /* record too long, silently discard it */

629 rr->length = 0;

630 s->packet_length = 0;

631 goto again;

632 }

633

634 /* now s->rstate == SSL_ST_READ_BODY */

635 }

636

637 /* s->rstate == SSL_ST_READ_BODY, get and decode the data */

638

639 if (rr->length > s->packet_length-DTLS1_RT_HEADER_LENGTH)

640 {

641 /* now s->packet_length == DTLS1_RT_HEADER_LENGTH */

642 i=rr->length;

643 n=ssl3_read_n(s,i,i,1);

644 if (n <= 0) return(n); /* error or non-blocking io */

645

646 /* this packet contained a partial record, dump it */

647 if ( n != i)

648 {

649 rr->length = 0;

650 s->packet_length = 0;

651 goto again;

652 }

653

654 /* now n == rr->length,

655 * and s->packet_length == DTLS1_RT_HEADER_LENGTH + rr->length * /

656 }

657 s->rstate=SSL_ST_READ_HEADER; /* set state for later operations */

658

659 /* match epochs. NULL means the packet is dropped on the floor */

660 bitmap = dtls1_get_bitmap(s, rr, &is_next_epoch);

661 if ( bitmap == NULL)

662 {

663 rr->length = 0;

664 s->packet_length = 0; /* dump this record */

665 goto again; /* get another record */

666 }

667

668 #ifndef OPENSSL_NO_SCTP

669 /* Only do replay check if no SCTP bio */

670 if (!BIO_dgram_is_sctp(SSL_get_rbio(s)))

671 {

672 #endif

673 /* Check whether this is a repeat, or aged record.

674 * Don't check if we're listening and this message is

675 * a ClientHello. They can look as if they're replayed,

676 * since they arrive from different connections and

677 * would be dropped unnecessarily.

678 */

679 if (!(s->d1->listen && rr->type == SSL3_RT_HANDSHAKE &&

680 *p == SSL3_MT_CLIENT_HELLO) &&

681 !dtls1_record_replay_check(s, bitmap))

682 {

683 rr->length = 0;

684 s->packet_length=0; /* dump this record */

685 goto again; /* get another record */

686 }

687 #ifndef OPENSSL_NO_SCTP

688 }

689 #endif

690

691 /* just read a 0 length packet */

692 if (rr->length == 0) goto again;

693

694 /* If this record is from the next epoch (either HM or ALERT),

695 * and a handshake is currently in progress, buffer it since it

696 * cannot be processed at this time. However, do not buffer

697 * anything while listening.

698 */

699 if (is_next_epoch)

700 {

701 if ((SSL_in_init(s) \|\| s->in_handshake) && !s->d1->listen)

702 {

703 dtls1_buffer_record(s, &(s->d1->unprocessed_rcds), rr->s eq_num);

704 }

705 rr->length = 0;

706 s->packet_length = 0;

707 goto again;

708 }

709

710 if (!dtls1_process_record(s))

711 {

712 rr->length = 0;

713 s->packet_length = 0; /* dump this record */

714 goto again; /* get another record */

715 }

716

717 return(1);

718

719 }

720

721 /* Return up to 'len' payload bytes received in 'type' records.

722 * 'type' is one of the following:

723 *

724 * - SSL3_RT_HANDSHAKE (when ssl3_get_message calls us)

725 * - SSL3_RT_APPLICATION_DATA (when ssl3_read calls us)

726 * - 0 (during a shutdown, no data has to be returned)

727 *

728 * If we don't have stored data to work from, read a SSL/TLS record first

729 * (possibly multiple records if we still don't have anything to return).

730 *

731 * This function must handle any surprises the peer may have for us, such as

732 * Alert records (e.g. close_notify), ChangeCipherSpec records (not really

733 * a surprise, but handled as if it were), or renegotiation requests.

734 * Also if record payloads contain fragments too small to process, we store

735 * them until there is enough for the respective protocol (the record protocol

736 * may use arbitrary fragmentation and even interleaving):

737 * Change cipher spec protocol

738 * just 1 byte needed, no need for keeping anything stored

739 * Alert protocol

740 * 2 bytes needed (AlertLevel, AlertDescription)

741 * Handshake protocol

742 * 4 bytes needed (HandshakeType, uint24 length) -- we just have

743 * to detect unexpected Client Hello and Hello Request messages

744 * here, anything else is handled by higher layers

745 * Application data protocol

746 * none of our business

747 */

748 int dtls1_read_bytes(SSL s, int type, unsigned char buf, int len, int peek)

749 {

750 int al,i,j,ret;

751 unsigned int n;

752 SSL3_RECORD *rr;

753 void (cb)(const SSL ssl,int type2,int val)=NULL;

754

755 if (s->s3->rbuf.buf == NULL) /* Not initialized yet */

756 if (!ssl3_setup_buffers(s))

757 return(-1);

758

759 /* XXX: check what the second '&& type' is about */

760 if ((type && (type != SSL3_RT_APPLICATION_DATA) &&

761 (type != SSL3_RT_HANDSHAKE) && type) \|\|

762 (peek && (type != SSL3_RT_APPLICATION_DATA)))

763 {

764 SSLerr(SSL_F_DTLS1_READ_BYTES, ERR_R_INTERNAL_ERROR);

765 return -1;

766 }

767

768 /* check whether there's a handshake message (client hello?) waiting */

769 if ( (ret = have_handshake_fragment(s, type, buf, len, peek)))

770 return ret;

771

772 /* Now s->d1->handshake_fragment_len == 0 if type == SSL3_RT_HANDSHAKE. */

773

774 #ifndef OPENSSL_NO_SCTP

775 /* Continue handshake if it had to be interrupted to read

776 * app data with SCTP.

777 */

778 if ((!s->in_handshake && SSL_in_init(s)) \|\|

779 (BIO_dgram_is_sctp(SSL_get_rbio(s)) &&

780 (s->state == DTLS1_SCTP_ST_SR_READ_SOCK \|\| s->state == DTLS1_SCTP_S T_CR_READ_SOCK) &&

781 s->s3->in_read_app_data != 2))

782 #else

783 if (!s->in_handshake && SSL_in_init(s))

784 #endif

785 {

786 /* type == SSL3_RT_APPLICATION_DATA */

787 i=s->handshake_func(s);

788 if (i < 0) return(i);

789 if (i == 0)

790 {

791 SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILUR E);

792 return(-1);

793 }

794 }

795

796 start:

797 s->rwstate=SSL_NOTHING;

798

799 /* s->s3->rrec.type - is the type of record

800 * s->s3->rrec.data, - data

801 * s->s3->rrec.off, - offset into 'data' for next read

802 * s->s3->rrec.length, - number of bytes. */

803 rr = &(s->s3->rrec);

804

805 /* We are not handshaking and have no data yet,

806 * so process data buffered during the last handshake

807 * in advance, if any.

808 */

809 if (s->state == SSL_ST_OK && rr->length == 0)

810 {

811 pitem *item;

812 item = pqueue_pop(s->d1->buffered_app_data.q);

813 if (item)

814 {

815 #ifndef OPENSSL_NO_SCTP

816 /* Restore bio_dgram_sctp_rcvinfo struct */

817 if (BIO_dgram_is_sctp(SSL_get_rbio(s)))

818 {

819 DTLS1_RECORD_DATA rdata = (DTLS1_RECORD_DATA ) item->data;

820 BIO_ctrl(SSL_get_rbio(s), BIO_CTRL_DGRAM_SCTP_SE T_RCVINFO, sizeof(rdata->recordinfo), &rdata->recordinfo);

821 }

822 #endif

823

824 dtls1_copy_record(s, item);

825

826 OPENSSL_free(item->data);

827 pitem_free(item);

828 }

829 }

830

831 /* Check for timeout */

832 if (dtls1_handle_timeout(s) > 0)

833 goto start;

834

835 /* get new packet if necessary */

836 if ((rr->length == 0) \|\| (s->rstate == SSL_ST_READ_BODY))

837 {

838 ret=dtls1_get_record(s);

839 if (ret <= 0)

840 {

841 ret = dtls1_read_failed(s, ret);

842 /* anything other than a timeout is an error */

843 if (ret <= 0)

844 return(ret);

845 else

846 goto start;

847 }

848 }

849

850 /* we now have a packet which can be read and processed */

851

852 if (s->s3->change_cipher_spec /* set when we receive ChangeCipherSpec,

853 * reset by ssl3_get_finished */

854 && (rr->type != SSL3_RT_HANDSHAKE))

855 {

856 /* We now have application data between CCS and Finished.

857 * Most likely the packets were reordered on their way, so

858 * buffer the application data for later processing rather

859 * than dropping the connection.

860 */

861 dtls1_buffer_record(s, &(s->d1->buffered_app_data), rr->seq_num) ;

862 rr->length = 0;

863 goto start;

864 }

865

866 /* If the other end has shut down, throw anything we read away

867 * (even in 'peek' mode) */

868 if (s->shutdown & SSL_RECEIVED_SHUTDOWN)

869 {

870 rr->length=0;

871 s->rwstate=SSL_NOTHING;

872 return(0);

873 }

874

875

876 if (type == rr->type) /* SSL3_RT_APPLICATION_DATA or SSL3_RT_HANDSHAKE * /

877 {

878 /* make sure that we are not getting application data when we

879 * are doing a handshake for the first time */

880 if (SSL_in_init(s) && (type == SSL3_RT_APPLICATION_DATA) &&

881 (s->enc_read_ctx == NULL))

882 {

883 al=SSL_AD_UNEXPECTED_MESSAGE;

884 SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_APP_DATA_IN_HANDSHAK E);

885 goto f_err;

886 }

887

888 if (len <= 0) return(len);

889

890 if ((unsigned int)len > rr->length)

891 n = rr->length;

892 else

893 n = (unsigned int)len;

894

895 memcpy(buf,&(rr->data[rr->off]),n);

896 if (!peek)

897 {

898 rr->length-=n;

899 rr->off+=n;

900 if (rr->length == 0)

901 {

902 s->rstate=SSL_ST_READ_HEADER;

903 rr->off=0;

904 }

905 }

906

907 #ifndef OPENSSL_NO_SCTP

908 /* We were about to renegotiate but had to read

909 * belated application data first, so retry.

910 */

911 if (BIO_dgram_is_sctp(SSL_get_rbio(s)) &&

912 rr->type == SSL3_RT_APPLICATION_DATA &&

913 (s->state == DTLS1_SCTP_ST_SR_READ_SOCK \|\| s->state == DTLS1_SCTP_ST_CR_READ_SOCK))

914 {

915 s->rwstate=SSL_READING;

916 BIO_clear_retry_flags(SSL_get_rbio(s));

917 BIO_set_retry_read(SSL_get_rbio(s));

918 }

919

920 /* We might had to delay a close_notify alert because

921 * of reordered app data. If there was an alert and ther e

922 * is no message to read anymore, finally set shutdown.

923 */

924 if (BIO_dgram_is_sctp(SSL_get_rbio(s)) &&

925 s->d1->shutdown_received && !BIO_dgram_sctp_msg_wait ing(SSL_get_rbio(s)))

926 {

927 s->shutdown \|= SSL_RECEIVED_SHUTDOWN;

928 return(0);

929 }

930 #endif

931 return(n);

932 }

933

934

935 /* If we get here, then type != rr->type; if we have a handshake

936 * message, then it was unexpected (Hello Request or Client Hello). */

937

938 /* In case of record types for which we have 'fragment' storage,

939 * fill that so that we can process the data at a fixed place.

940 */

941 {

942 unsigned int k, dest_maxlen = 0;

943 unsigned char *dest = NULL;

944 unsigned int *dest_len = NULL;

945

946 if (rr->type == SSL3_RT_HANDSHAKE)

947 {

948 dest_maxlen = sizeof s->d1->handshake_fragment;

949 dest = s->d1->handshake_fragment;

950 dest_len = &s->d1->handshake_fragment_len;

951 }

952 else if (rr->type == SSL3_RT_ALERT)

953 {

954 dest_maxlen = sizeof(s->d1->alert_fragment);

955 dest = s->d1->alert_fragment;

956 dest_len = &s->d1->alert_fragment_len;

957 }

958 #ifndef OPENSSL_NO_HEARTBEATS

959 else if (rr->type == TLS1_RT_HEARTBEAT)

960 {

961 dtls1_process_heartbeat(s);

962

963 /* Exit and notify application to read again */

964 rr->length = 0;

965 s->rwstate=SSL_READING;

966 BIO_clear_retry_flags(SSL_get_rbio(s));

967 BIO_set_retry_read(SSL_get_rbio(s));

968 return(-1);

969 }

970 #endif

971 /* else it's a CCS message, or application data or wrong */

972 else if (rr->type != SSL3_RT_CHANGE_CIPHER_SPEC)

973 {

974 /* Application data while renegotiating

975 * is allowed. Try again reading.

976 */

977 if (rr->type == SSL3_RT_APPLICATION_DATA)

978 {

979 BIO *bio;

980 s->s3->in_read_app_data=2;

981 bio=SSL_get_rbio(s);

982 s->rwstate=SSL_READING;

983 BIO_clear_retry_flags(bio);

984 BIO_set_retry_read(bio);

985 return(-1);

986 }

987

988 /* Not certain if this is the right error handling */

989 al=SSL_AD_UNEXPECTED_MESSAGE;

990 SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_UNEXPECTED_RECORD);

991 goto f_err;

992 }

993

994 if (dest_maxlen > 0)

995 {

996 /* XDTLS: In a pathalogical case, the Client Hello

997 * may be fragmented--don't always expect dest_maxlen bytes */

998 if ( rr->length < dest_maxlen)

999 {

1000 #ifdef DTLS1_AD_MISSING_HANDSHAKE_MESSAGE

1001 /*

1002 * for normal alerts rr->length is 2, while

1003 * dest_maxlen is 7 if we were to handle this

1004 * non-existing alert...

1005 */

1006 FIX ME

1007 #endif

1008 s->rstate=SSL_ST_READ_HEADER;

1009 rr->length = 0;

1010 goto start;

1011 }

1012

1013 /* now move 'n' bytes: */

1014 for ( k = 0; k < dest_maxlen; k++)

1015 {

1016 dest[k] = rr->data[rr->off++];

1017 rr->length--;

1018 }

1019 *dest_len = dest_maxlen;

1020 }

1021 }

1022

1023 /* s->d1->handshake_fragment_len == 12 iff rr->type == SSL3_RT_HANDSHA KE;

1024 * s->d1->alert_fragment_len == 7 iff rr->type == SSL3_RT_ALERT.

1025 * (Possibly rr is 'empty' now, i.e. rr->length may be 0.) */

1026

1027 /* If we are a client, check for an incoming 'Hello Request': */

1028 if ((!s->server) &&

1029 (s->d1->handshake_fragment_len >= DTLS1_HM_HEADER_LENGTH) &&

1030 (s->d1->handshake_fragment[0] == SSL3_MT_HELLO_REQUEST) &&

1031 (s->session != NULL) && (s->session->cipher != NULL))

1032 {

1033 s->d1->handshake_fragment_len = 0;

1034

1035 if ((s->d1->handshake_fragment[1] != 0) \|\|

1036 (s->d1->handshake_fragment[2] != 0) \|\|

1037 (s->d1->handshake_fragment[3] != 0))

1038 {

1039 al=SSL_AD_DECODE_ERROR;

1040 SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_BAD_HELLO_REQUEST);

1041 goto err;

1042 }

1043

1044 /* no need to check sequence number on HELLO REQUEST messages */

1045

1046 if (s->msg_callback)

1047 s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,

1048 s->d1->handshake_fragment, 4, s, s->msg_callback _arg);

1049

1050 if (SSL_is_init_finished(s) &&

1051 !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) &&

1052 !s->s3->renegotiate)

1053 {

1054 s->new_session = 1;

1055 ssl3_renegotiate(s);

1056 if (ssl3_renegotiate_check(s))

1057 {

1058 i=s->handshake_func(s);

1059 if (i < 0) return(i);

1060 if (i == 0)

1061 {

1062 SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_SSL_ HANDSHAKE_FAILURE);

1063 return(-1);

1064 }

1065

1066 if (!(s->mode & SSL_MODE_AUTO_RETRY))

1067 {

1068 if (s->s3->rbuf.left == 0) /* no read-ah ead left? */

1069 {

1070 BIO *bio;

1071 /* In the case where we try to r ead application data,

1072 * but we trigger an SSL handsha ke, we return -1 with

1073 * the retry option set. Otherw ise renegotiation may

1074 * cause nasty problems in the b locking world */

1075 s->rwstate=SSL_READING;

1076 bio=SSL_get_rbio(s);

1077 BIO_clear_retry_flags(bio);

1078 BIO_set_retry_read(bio);

1079 return(-1);

1080 }

1081 }

1082 }

1083 }

1084 /* we either finished a handshake or ignored the request,

1085 * now try again to obtain the (application) data we were asked for */

1086 goto start;

1087 }

1088

1089 if (s->d1->alert_fragment_len >= DTLS1_AL_HEADER_LENGTH)

1090 {

1091 int alert_level = s->d1->alert_fragment[0];

1092 int alert_descr = s->d1->alert_fragment[1];

1093

1094 s->d1->alert_fragment_len = 0;

1095

1096 if (s->msg_callback)

1097 s->msg_callback(0, s->version, SSL3_RT_ALERT,

1098 s->d1->alert_fragment, 2, s, s->msg_callback_arg );

1099

1100 if (s->info_callback != NULL)

1101 cb=s->info_callback;

1102 else if (s->ctx->info_callback != NULL)

1103 cb=s->ctx->info_callback;

1104

1105 if (cb != NULL)

1106 {

1107 j = (alert_level << 8) \| alert_descr;

1108 cb(s, SSL_CB_READ_ALERT, j);

1109 }

1110

1111 if (alert_level == 1) /* warning */

1112 {

1113 s->s3->warn_alert = alert_descr;

1114 if (alert_descr == SSL_AD_CLOSE_NOTIFY)

1115 {

1116 #ifndef OPENSSL_NO_SCTP

1117 /* With SCTP and streams the socket may deliver app data

1118 * after a close_notify alert. We have to check this

1119 * first so that nothing gets discarded.

1120 */

1121 if (BIO_dgram_is_sctp(SSL_get_rbio(s)) &&

1122 BIO_dgram_sctp_msg_waiting(SSL_get_rbio( s)))

1123 {

1124 s->d1->shutdown_received = 1;

1125 s->rwstate=SSL_READING;

1126 BIO_clear_retry_flags(SSL_get_rbio(s));

1127 BIO_set_retry_read(SSL_get_rbio(s));

1128 return -1;

1129 }

1130 #endif

1131 s->shutdown \|= SSL_RECEIVED_SHUTDOWN;

1132 return(0);

1133 }

1134 #if 0

1135 /* XXX: this is a possible improvement in the future */

1136 /* now check if it's a missing record */

1137 if (alert_descr == DTLS1_AD_MISSING_HANDSHAKE_MESSAGE)

1138 {

1139 unsigned short seq;

1140 unsigned int frag_off;

1141 unsigned char *p = &(s->d1->alert_fragment[2]);

1142

1143 n2s(p, seq);

1144 n2l3(p, frag_off);

1145

1146 dtls1_retransmit_message(s,

1147 dtls1_get_queue_priority(frag->msg_header.seq, 0),

1148 frag_off, &found);

1149 if ( ! found && SSL_in_init(s))

1150 {

1151 /* fprintf( stderr,"in init = %d\n", SSL _in_init(s)); */

1152 /* requested a message not yet sent,

1153 send an alert ourselves */

1154 ssl3_send_alert(s,SSL3_AL_WARNING,

1155 DTLS1_AD_MISSING_HANDSHAKE_MESSA GE);

1156 }

1157 }

1158 #endif

1159 }

1160 else if (alert_level == 2) /* fatal */

1161 {

1162 char tmp[16];

1163

1164 s->rwstate=SSL_NOTHING;

1165 s->s3->fatal_alert = alert_descr;

1166 SSLerr(SSL_F_DTLS1_READ_BYTES, SSL_AD_REASON_OFFSET + al ert_descr);

1167 BIO_snprintf(tmp,sizeof tmp,"%d",alert_descr);

1168 ERR_add_error_data(2,"SSL alert number ",tmp);

1169 s->shutdown\|=SSL_RECEIVED_SHUTDOWN;

1170 SSL_CTX_remove_session(s->ctx,s->session);

1171 return(0);

1172 }

1173 else

1174 {

1175 al=SSL_AD_ILLEGAL_PARAMETER;

1176 SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_UNKNOWN_ALERT_TYPE);

1177 goto f_err;

1178 }

1179

1180 goto start;

1181 }

1182

1183 if (s->shutdown & SSL_SENT_SHUTDOWN) /* but we have not received a shutd own */

1184 {

1185 s->rwstate=SSL_NOTHING;

1186 rr->length=0;

1187 return(0);

1188 }

1189

1190 if (rr->type == SSL3_RT_CHANGE_CIPHER_SPEC)

1191 {

1192 struct ccs_header_st ccs_hdr;

1193 unsigned int ccs_hdr_len = DTLS1_CCS_HEADER_LENGTH;

1194

1195 dtls1_get_ccs_header(rr->data, &ccs_hdr);

1196

1197 if (s->version == DTLS1_BAD_VER)

1198 ccs_hdr_len = 3;

1199

1200 /* 'Change Cipher Spec' is just a single byte, so we know

1201 * exactly what the record payload has to look like */

1202 /* XDTLS: check that epoch is consistent */

1203 if ( (rr->length != ccs_hdr_len) \|\|

1204 (rr->off != 0) \|\| (rr->data[0] != SSL3_MT_CCS))

1205 {

1206 i=SSL_AD_ILLEGAL_PARAMETER;

1207 SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_BAD_CHANGE_CIPHER_SP EC);

1208 goto err;

1209 }

1210

1211 rr->length=0;

1212

1213 if (s->msg_callback)

1214 s->msg_callback(0, s->version, SSL3_RT_CHANGE_CIPHER_SPE C,

1215 rr->data, 1, s, s->msg_callback_arg);

1216

1217 /* We can't process a CCS now, because previous handshake

1218 * messages are still missing, so just drop it.

1219 */

1220 if (!s->d1->change_cipher_spec_ok)

1221 {

1222 goto start;

1223 }

1224

1225 s->d1->change_cipher_spec_ok = 0;

1226

1227 s->s3->change_cipher_spec=1;

1228 if (!ssl3_do_change_cipher_spec(s))

1229 goto err;

1230

1231 /* do this whenever CCS is processed */

1232 dtls1_reset_seq_numbers(s, SSL3_CC_READ);

1233

1234 if (s->version == DTLS1_BAD_VER)

1235 s->d1->handshake_read_seq++;

1236

1237 #ifndef OPENSSL_NO_SCTP

1238 /* Remember that a CCS has been received,

1239 * so that an old key of SCTP-Auth can be

1240 * deleted when a CCS is sent. Will be ignored

1241 * if no SCTP is used

1242 */

1243 BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_AUTH_CCS_RCVD, 1, NULL);

1244 #endif

1245

1246 goto start;

1247 }

1248

1249 /* Unexpected handshake message (Client Hello, or protocol violation) */

1250 if ((s->d1->handshake_fragment_len >= DTLS1_HM_HEADER_LENGTH) &&

1251 !s->in_handshake)

1252 {

1253 struct hm_header_st msg_hdr;

1254

1255 /* this may just be a stale retransmit */

1256 dtls1_get_message_header(rr->data, &msg_hdr);

1257 if( rr->epoch != s->d1->r_epoch)

1258 {

1259 rr->length = 0;

1260 goto start;

1261 }

1262

1263 /* If we are server, we may have a repeated FINISHED of the

1264 * client here, then retransmit our CCS and FINISHED.

1265 */

1266 if (msg_hdr.type == SSL3_MT_FINISHED)

1267 {

1268 if (dtls1_check_timeout_num(s) < 0)

1269 return -1;

1270

1271 dtls1_retransmit_buffered_messages(s);

1272 rr->length = 0;

1273 goto start;

1274 }

1275

1276 if (((s->state&SSL_ST_MASK) == SSL_ST_OK) &&

1277 !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS))

1278 {

1279 #if 0 /* worked only because C operator preferences are not as expected (and

1280 * because this is not really needed for clients except for detecting

1281 * protocol violations): */

1282 s->state=SSL_ST_BEFORE\|(s->server)

1283 ?SSL_ST_ACCEPT

1284 :SSL_ST_CONNECT;

1285 #else

1286 s->state = s->server ? SSL_ST_ACCEPT : SSL_ST_CONNECT;

1287 #endif

1288 s->renegotiate=1;

1289 s->new_session=1;

1290 }

1291 i=s->handshake_func(s);

1292 if (i < 0) return(i);

1293 if (i == 0)

1294 {

1295 SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILUR E);

1296 return(-1);

1297 }

1298

1299 if (!(s->mode & SSL_MODE_AUTO_RETRY))

1300 {

1301 if (s->s3->rbuf.left == 0) /* no read-ahead left? */

1302 {

1303 BIO *bio;

1304 /* In the case where we try to read application data,

1305 * but we trigger an SSL handshake, we return -1 with

1306 * the retry option set. Otherwise renegotiatio n may

1307 * cause nasty problems in the blocking world */

1308 s->rwstate=SSL_READING;

1309 bio=SSL_get_rbio(s);

1310 BIO_clear_retry_flags(bio);

1311 BIO_set_retry_read(bio);

1312 return(-1);

1313 }

1314 }

1315 goto start;

1316 }

1317

1318 switch (rr->type)

1319 {

1320 default:

1321 #ifndef OPENSSL_NO_TLS

1322 /* TLS just ignores unknown message types */

1323 if (s->version == TLS1_VERSION)

1324 {

1325 rr->length = 0;

1326 goto start;

1327 }

1328 #endif

1329 al=SSL_AD_UNEXPECTED_MESSAGE;

1330 SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_UNEXPECTED_RECORD);

1331 goto f_err;

1332 case SSL3_RT_CHANGE_CIPHER_SPEC:

1333 case SSL3_RT_ALERT:

1334 case SSL3_RT_HANDSHAKE:

1335 /* we already handled all of these, with the possible exception

1336 * of SSL3_RT_HANDSHAKE when s->in_handshake is set, but that

1337 * should not happen when type != rr->type */

1338 al=SSL_AD_UNEXPECTED_MESSAGE;

1339 SSLerr(SSL_F_DTLS1_READ_BYTES,ERR_R_INTERNAL_ERROR);

1340 goto f_err;

1341 case SSL3_RT_APPLICATION_DATA:

1342 /* At this point, we were expecting handshake data,

1343 * but have application data. If the library was

1344 * running inside ssl3_read() (i.e. in_read_app_data

1345 * is set) and it makes sense to read application data

1346 * at this point (session renegotiation not yet started),

1347 * we will indulge it.

1348 */

1349 if (s->s3->in_read_app_data &&

1350 (s->s3->total_renegotiations != 0) &&

1351 ((

1352 (s->state & SSL_ST_CONNECT) &&

1353 (s->state >= SSL3_ST_CW_CLNT_HELLO_A) &&

1354 (s->state <= SSL3_ST_CR_SRVR_HELLO_A)

1355 ) \|\| (

1356 (s->state & SSL_ST_ACCEPT) &&

1357 (s->state <= SSL3_ST_SW_HELLO_REQ_A) &&

1358 (s->state >= SSL3_ST_SR_CLNT_HELLO_A)

1359 )

1360 ))

1361 {

1362 s->s3->in_read_app_data=2;

1363 return(-1);

1364 }

1365 else

1366 {

1367 al=SSL_AD_UNEXPECTED_MESSAGE;

1368 SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_UNEXPECTED_RECORD);

1369 goto f_err;

1370 }

1371 }

1372 /* not reached */

1373

1374 f_err:

1375 ssl3_send_alert(s,SSL3_AL_FATAL,al);

1376 err:

1377 return(-1);

1378 }

1379

1380 int

1381 dtls1_write_app_data_bytes(SSL s, int type, const void buf_, int len)

1382 {

1383 int i;

1384

1385 #ifndef OPENSSL_NO_SCTP

1386 /* Check if we have to continue an interrupted handshake

1387 * for reading belated app data with SCTP.

1388 */

1389 if ((SSL_in_init(s) && !s->in_handshake) \|\|

1390 (BIO_dgram_is_sctp(SSL_get_wbio(s)) &&

1391 (s->state == DTLS1_SCTP_ST_SR_READ_SOCK \|\| s->state == DTLS 1_SCTP_ST_CR_READ_SOCK)))

1392 #else

1393 if (SSL_in_init(s) && !s->in_handshake)

1394 #endif

1395 {

1396 i=s->handshake_func(s);

1397 if (i < 0) return(i);

1398 if (i == 0)

1399 {

1400 SSLerr(SSL_F_DTLS1_WRITE_APP_DATA_BYTES,SSL_R_SSL_HANDSH AKE_FAILURE);

1401 return -1;

1402 }

1403 }

1404

1405 if (len > SSL3_RT_MAX_PLAIN_LENGTH)

1406 {

1407 SSLerr(SSL_F_DTLS1_WRITE_APP_DATA_BYTES,SSL_R_DTLS_MESSA GE_TOO_BIG);

1408 return -1;

1409 }

1410

1411 i = dtls1_write_bytes(s, type, buf_, len);

1412 return i;

1413 }

1414

1415

1416 /* this only happens when a client hello is received and a handshake

1417 * is started. */

1418 static int

1419 have_handshake_fragment(SSL s, int type, unsigned char buf,

1420 int len, int peek)

1421 {

1422

1423 if ((type == SSL3_RT_HANDSHAKE) && (s->d1->handshake_fragment_len > 0))

1424 /* (partially) satisfy request from storage */

1425 {

1426 unsigned char *src = s->d1->handshake_fragment;

1427 unsigned char *dst = buf;

1428 unsigned int k,n;

1429

1430 /* peek == 0 */

1431 n = 0;

1432 while ((len > 0) && (s->d1->handshake_fragment_len > 0))

1433 {

1434 dst++ = src++;

1435 len--; s->d1->handshake_fragment_len--;

1436 n++;

1437 }

1438 /* move any remaining fragment bytes: */

1439 for (k = 0; k < s->d1->handshake_fragment_len; k++)

1440 s->d1->handshake_fragment[k] = *src++;

1441 return n;

1442 }

1443

1444 return 0;

1445 }

1446

1447

1448

1449

1450 /* Call this to write data in records of type 'type'

1451 * It will return <= 0 if not all data has been sent or non-blocking IO.

1452 */

1453 int dtls1_write_bytes(SSL s, int type, const void buf, int len)

1454 {

1455 int i;

1456

1457 OPENSSL_assert(len <= SSL3_RT_MAX_PLAIN_LENGTH);

1458 s->rwstate=SSL_NOTHING;

1459 i=do_dtls1_write(s, type, buf, len, 0);

1460 return i;

1461 }

1462

1463 int do_dtls1_write(SSL s, int type, const unsigned char buf, unsigned int len, int create_empty_fragment)

1464 {

1465 unsigned char p,pseq;

1466 int i,mac_size,clear=0;

1467 int prefix_len = 0;

1468 SSL3_RECORD *wr;

1469 SSL3_BUFFER *wb;

1470 SSL_SESSION *sess;

1471 int bs;

1472

1473 /* first check if there is a SSL3_BUFFER still being written

1474 * out. This will happen with non blocking IO */

1475 if (s->s3->wbuf.left != 0)

1476 {

1477 OPENSSL_assert(0); /* XDTLS: want to see if we ever get here */

1478 return(ssl3_write_pending(s,type,buf,len));

1479 }

1480

1481 /* If we have an alert to send, lets send it */

1482 if (s->s3->alert_dispatch)

1483 {

1484 i=s->method->ssl_dispatch_alert(s);

1485 if (i <= 0)

1486 return(i);

1487 /* if it went, fall through and send more stuff */

1488 }

1489

1490 if (len == 0 && !create_empty_fragment)

1491 return 0;

1492

1493 wr= &(s->s3->wrec);

1494 wb= &(s->s3->wbuf);

1495 sess=s->session;

1496

1497 if ( (sess == NULL) \|\|

1498 (s->enc_write_ctx == NULL) \|\|

1499 (EVP_MD_CTX_md(s->write_hash) == NULL))

1500 clear=1;

1501

1502 if (clear)

1503 mac_size=0;

1504 else

1505 {

1506 mac_size=EVP_MD_CTX_size(s->write_hash);

1507 if (mac_size < 0)

1508 goto err;

1509 }

1510

1511 /* DTLS implements explicit IV, so no need for empty fragments */

1512 #if 0

1513 /* 'create_empty_fragment' is true only when this function calls itself */

1514 if (!clear && !create_empty_fragment && !s->s3->empty_fragment_done

1515 && SSL_version(s) != DTLS1_VERSION && SSL_version(s) != DTLS1_BAD_VE R)

1516 {

1517 /* countermeasure against known-IV weakness in CBC ciphersuites

1518 * (see http://www.openssl.org/~bodo/tls-cbc.txt)

1519 */

1520

1521 if (s->s3->need_empty_fragments && type == SSL3_RT_APPLICATION_D ATA)

1522 {

1523 /* recursive function call with 'create_empty_fragment' set;

1524 * this prepares and buffers the data for an empty fragm ent

1525 * (these 'prefix_len' bytes are sent out later

1526 * together with the actual payload) */

1527 prefix_len = s->method->do_ssl_write(s, type, buf, 0, 1) ;

1528 if (prefix_len <= 0)

1529 goto err;

1530

1531 if (s->s3->wbuf.len < (size_t)prefix_len + SSL3_RT_MAX_P ACKET_SIZE)

1532 {

1533 /* insufficient space */

1534 SSLerr(SSL_F_DO_DTLS1_WRITE, ERR_R_INTERNAL_ERRO R);

1535 goto err;

1536 }

1537 }

1538

1539 s->s3->empty_fragment_done = 1;

1540 }

1541 #endif

1542 p = wb->buf + prefix_len;

1543

1544 /* write the header */

1545

1546 *(p++)=type&0xff;

1547 wr->type=type;

1548

1549 *(p++)=(s->version>>8);

1550 *(p++)=s->version&0xff;

1551

1552 /* field where we are to write out packet epoch, seq num and len */

1553 pseq=p;

1554 p+=10;

1555

1556 /* lets setup the record stuff. */

1557

1558 /* Make space for the explicit IV in case of CBC.

1559 * (this is a bit of a boundary violation, but what the heck).

1560 */

1561 if ( s->enc_write_ctx &&

1562 (EVP_CIPHER_mode( s->enc_write_ctx->cipher ) & EVP_CIPH_CBC_MODE ))

1563 bs = EVP_CIPHER_block_size(s->enc_write_ctx->cipher);

1564 else

1565 bs = 0;

1566

1567 wr->data=p + bs; /* make room for IV in case of CBC */

1568 wr->length=(int)len;

1569 wr->input=(unsigned char *)buf;

1570

1571 /* we now 'read' from wr->input, wr->length bytes into

1572 * wr->data */

1573

1574 /* first we compress */

1575 if (s->compress != NULL)

1576 {

1577 if (!ssl3_do_compress(s))

1578 {

1579 SSLerr(SSL_F_DO_DTLS1_WRITE,SSL_R_COMPRESSION_FAILURE);

1580 goto err;

1581 }

1582 }

1583 else

1584 {

1585 memcpy(wr->data,wr->input,wr->length);

1586 wr->input=wr->data;

1587 }

1588

1589 /* we should still have the output to wr->data and the input

1590 * from wr->input. Length should be wr->length.

1591 * wr->data still points in the wb->buf */

1592

1593 if (mac_size != 0)

1594 {

1595 if(s->method->ssl3_enc->mac(s,&(p[wr->length + bs]),1) < 0)

1596 goto err;

1597 wr->length+=mac_size;

1598 }

1599

1600 /* this is true regardless of mac size */

1601 wr->input=p;

1602 wr->data=p;

1603

1604

1605 /* ssl3_enc can only have an error on read */

1606 if (bs) /* bs != 0 in case of CBC */

1607 {

1608 RAND_pseudo_bytes(p,bs);

1609 /* master IV and last CBC residue stand for

1610 * the rest of randomness */

1611 wr->length += bs;

1612 }

1613

1614 s->method->ssl3_enc->enc(s,1);

1615

1616 /* record length after mac and block padding */

1617 /* if (type == SSL3_RT_APPLICATION_DATA \|\|

1618 (type == SSL3_RT_ALERT && ! SSL_in_init(s))) */

1619

1620 /* there's only one epoch between handshake and app data */

1621

1622 s2n(s->d1->w_epoch, pseq);

1623

1624 /* XDTLS: ?? */

1625 /* else

1626 s2n(s->d1->handshake_epoch, pseq); */

1627

1628 memcpy(pseq, &(s->s3->write_sequence[2]), 6);

1629 pseq+=6;

1630 s2n(wr->length,pseq);

1631

1632 /* we should now have

1633 * wr->data pointing to the encrypted data, which is

1634 * wr->length long */

1635 wr->type=type; /* not needed but helps for debugging */

1636 wr->length+=DTLS1_RT_HEADER_LENGTH;

1637

1638 #if 0 /* this is now done at the message layer */

1639 /* buffer the record, making it easy to handle retransmits */

1640 if ( type == SSL3_RT_HANDSHAKE \|\| type == SSL3_RT_CHANGE_CIPHER_SPEC)

1641 dtls1_buffer_record(s, wr->data, wr->length,

1642 ((PQ_64BIT )&(s->s3->write_sequence[0])));

1643 #endif

1644

1645 ssl3_record_sequence_update(&(s->s3->write_sequence[0]));

1646

1647 if (create_empty_fragment)

1648 {

1649 /* we are in a recursive call;

1650 * just return the length, don't write out anything here

1651 */

1652 return wr->length;

1653 }

1654

1655 /* now let's set up wb */

1656 wb->left = prefix_len + wr->length;

1657 wb->offset = 0;

1658

1659 /* memorize arguments so that ssl3_write_pending can detect bad write re tries later */

1660 s->s3->wpend_tot=len;

1661 s->s3->wpend_buf=buf;

1662 s->s3->wpend_type=type;

1663 s->s3->wpend_ret=len;

1664

1665 /* we now just need to write the buffer */

1666 return ssl3_write_pending(s,type,buf,len);

1667 err:

1668 return -1;

1669 }

1670

1671

1672

1673 static int dtls1_record_replay_check(SSL s, DTLS1_BITMAP bitmap)

1674 {

1675 int cmp;

1676 unsigned int shift;

1677 const unsigned char *seq = s->s3->read_sequence;

1678

1679 cmp = satsub64be(seq,bitmap->max_seq_num);

1680 if (cmp > 0)

1681 {

1682 memcpy (s->s3->rrec.seq_num,seq,8);

1683 return 1; /* this record in new */

1684 }

1685 shift = -cmp;

1686 if (shift >= sizeof(bitmap->map)*8)

1687 return 0; /* stale, outside the window */

1688 else if (bitmap->map & (1UL<<shift))

1689 return 0; /* record previously received */

1690

1691 memcpy (s->s3->rrec.seq_num,seq,8);

1692 return 1;

1693 }

1694

1695

1696 static void dtls1_record_bitmap_update(SSL s, DTLS1_BITMAP bitmap)

1697 {

1698 int cmp;

1699 unsigned int shift;

1700 const unsigned char *seq = s->s3->read_sequence;

1701

1702 cmp = satsub64be(seq,bitmap->max_seq_num);

1703 if (cmp > 0)

1704 {

1705 shift = cmp;

1706 if (shift < sizeof(bitmap->map)*8)

1707 bitmap->map <<= shift, bitmap->map \|= 1UL;

1708 else

1709 bitmap->map = 1UL;

1710 memcpy(bitmap->max_seq_num,seq,8);

1711 }

1712 else {

1713 shift = -cmp;

1714 if (shift < sizeof(bitmap->map)*8)

1715 bitmap->map \|= 1UL<<shift;

1716 }

1717 }

1718

1719

1720 int dtls1_dispatch_alert(SSL *s)

1721 {

1722 int i,j;

1723 void (cb)(const SSL ssl,int type,int val)=NULL;

1724 unsigned char buf[DTLS1_AL_HEADER_LENGTH];

1725 unsigned char *ptr = &buf[0];

1726

1727 s->s3->alert_dispatch=0;

1728

1729 memset(buf, 0x00, sizeof(buf));

1730 *ptr++ = s->s3->send_alert[0];

1731 *ptr++ = s->s3->send_alert[1];

1732

1733 #ifdef DTLS1_AD_MISSING_HANDSHAKE_MESSAGE

1734 if (s->s3->send_alert[1] == DTLS1_AD_MISSING_HANDSHAKE_MESSAGE)

1735 {

1736 s2n(s->d1->handshake_read_seq, ptr);

1737 #if 0

1738 if ( s->d1->r_msg_hdr.frag_off == 0) /* waiting for a new msg * /

1739

1740 else

1741 s2n(s->d1->r_msg_hdr.seq, ptr); /* partial msg read */

1742 #endif

1743

1744 #if 0

1745 fprintf(stderr, "s->d1->handshake_read_seq = %d, s->d1->r_msg_hd r.seq = %d\n",s->d1->handshake_read_seq,s->d1->r_msg_hdr.seq);

1746 #endif

1747 l2n3(s->d1->r_msg_hdr.frag_off, ptr);

1748 }

1749 #endif

1750

1751 i = do_dtls1_write(s, SSL3_RT_ALERT, &buf[0], sizeof(buf), 0);

1752 if (i <= 0)

1753 {

1754 s->s3->alert_dispatch=1;

1755 /* fprintf( stderr, "not done with alert\n" ); */

1756 }

1757 else

1758 {

1759 if (s->s3->send_alert[0] == SSL3_AL_FATAL

1760 #ifdef DTLS1_AD_MISSING_HANDSHAKE_MESSAGE

1761 \|\| s->s3->send_alert[1] == DTLS1_AD_MISSING_HANDSHAKE_MESSAG E

1762 #endif

1763 )

1764 (void)BIO_flush(s->wbio);

1765

1766 if (s->msg_callback)

1767 s->msg_callback(1, s->version, SSL3_RT_ALERT, s->s3->sen d_alert,

1768 2, s, s->msg_callback_arg);

1769

1770 if (s->info_callback != NULL)

1771 cb=s->info_callback;

1772 else if (s->ctx->info_callback != NULL)

1773 cb=s->ctx->info_callback;

1774

1775 if (cb != NULL)

1776 {

1777 j=(s->s3->send_alert[0]<<8)\|s->s3->send_alert[1];

1778 cb(s,SSL_CB_WRITE_ALERT,j);

1779 }

1780 }

1781 return(i);

1782 }

1783

1784

1785 static DTLS1_BITMAP *

1786 dtls1_get_bitmap(SSL s, SSL3_RECORD rr, unsigned int *is_next_epoch)

1787 {

1788

1789 *is_next_epoch = 0;

1790

1791 /* In current epoch, accept HM, CCS, DATA, & ALERT */

1792 if (rr->epoch == s->d1->r_epoch)

1793 return &s->d1->bitmap;

1794

1795 /* Only HM and ALERT messages can be from the next epoch */

1796 else if (rr->epoch == (unsigned long)(s->d1->r_epoch + 1) &&

1797 (rr->type == SSL3_RT_HANDSHAKE \|\|

1798 rr->type == SSL3_RT_ALERT))

1799 {

1800 *is_next_epoch = 1;

1801 return &s->d1->next_bitmap;

1802 }

1803

1804 return NULL;

1805 }

1806

1807 #if 0

1808 static int

1809 dtls1_record_needs_buffering(SSL s, SSL3_RECORD rr, unsigned short *priority,

1810 unsigned long *offset)

1811 {

1812

1813 /* alerts are passed up immediately */

1814 if ( rr->type == SSL3_RT_APPLICATION_DATA \|\|

1815 rr->type == SSL3_RT_ALERT)

1816 return 0;

1817

1818 /* Only need to buffer if a handshake is underway.

1819 * (this implies that Hello Request and Client Hello are passed up

1820 * immediately) */

1821 if ( SSL_in_init(s))

1822 {

1823 unsigned char *data = rr->data;

1824 /* need to extract the HM/CCS sequence number here */

1825 if ( rr->type == SSL3_RT_HANDSHAKE \|\|

1826 rr->type == SSL3_RT_CHANGE_CIPHER_SPEC)

1827 {

1828 unsigned short seq_num;

1829 struct hm_header_st msg_hdr;

1830 struct ccs_header_st ccs_hdr;

1831

1832 if ( rr->type == SSL3_RT_HANDSHAKE)

1833 {

1834 dtls1_get_message_header(data, &msg_hdr);

1835 seq_num = msg_hdr.seq;

1836 *offset = msg_hdr.frag_off;

1837 }

1838 else

1839 {

1840 dtls1_get_ccs_header(data, &ccs_hdr);

1841 seq_num = ccs_hdr.seq;

1842 *offset = 0;

1843 }

1844

1845 /* this is either a record we're waiting for, or a

1846 * retransmit of something we happened to previously

1847 * receive (higher layers will drop the repeat silently */

1848 if ( seq_num < s->d1->handshake_read_seq)

1849 return 0;

1850 if (rr->type == SSL3_RT_HANDSHAKE &&

1851 seq_num == s->d1->handshake_read_seq &&

1852 msg_hdr.frag_off < s->d1->r_msg_hdr.frag_off)

1853 return 0;

1854 else if ( seq_num == s->d1->handshake_read_seq &&

1855 (rr->type == SSL3_RT_CHANGE_CIPHER_SPEC \|\|

1856 msg_hdr.frag_off == s->d1->r_msg_hdr.fra g_off))

1857 return 0;

1858 else

1859 {

1860 *priority = seq_num;

1861 return 1;

1862 }

1863 }

1864 else /* unknown record type */

1865 return 0;

1866 }

1867

1868 return 0;

1869 }

1870 #endif

1871

1872 void

1873 dtls1_reset_seq_numbers(SSL *s, int rw)

1874 {

1875 unsigned char *seq;

1876 unsigned int seq_bytes = sizeof(s->s3->read_sequence);

1877

1878 if ( rw & SSL3_CC_READ)

1879 {

1880 seq = s->s3->read_sequence;

1881 s->d1->r_epoch++;

1882 memcpy(&(s->d1->bitmap), &(s->d1->next_bitmap), sizeof(DTLS1_BIT MAP));

1883 memset(&(s->d1->next_bitmap), 0x00, sizeof(DTLS1_BITMAP));

1884 }

1885 else

1886 {

1887 seq = s->s3->write_sequence;

1888 memcpy(s->d1->last_write_sequence, seq, sizeof(s->s3->write_sequ ence));

1889 s->d1->w_epoch++;

1890 }

1891

1892 memset(seq, 0x00, seq_bytes);

1893 }

OLD	NEW

« no previous file with comments | « openssl/ssl/d1_meth.c ('k') | openssl/ssl/d1_srtp.c » ('j') | no next file with comments »