/*
- * Copyright 2005-2016 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2005-2018 The OpenSSL Project Authors. All Rights Reserved.
*
- * Licensed under the OpenSSL license (the "License"). You may not use
+ * Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
#include <limits.h>
#include <string.h>
#include <stdio.h>
-#include "../ssl_locl.h"
-#include "statem_locl.h"
+#include "../ssl_local.h"
+#include "statem_local.h"
+#include "internal/cryptlib.h"
#include <openssl/buffer.h>
#include <openssl/objects.h>
#include <openssl/evp.h>
unsigned char *buf = NULL;
unsigned char *bitmask = NULL;
- frag = OPENSSL_malloc(sizeof(*frag));
- if (frag == NULL)
+ if ((frag = OPENSSL_malloc(sizeof(*frag))) == NULL) {
+ SSLerr(SSL_F_DTLS1_HM_FRAGMENT_NEW, ERR_R_MALLOC_FAILURE);
return NULL;
+ }
if (frag_len) {
- buf = OPENSSL_malloc(frag_len);
- if (buf == NULL) {
+ if ((buf = OPENSSL_malloc(frag_len)) == NULL) {
+ SSLerr(SSL_F_DTLS1_HM_FRAGMENT_NEW, ERR_R_MALLOC_FAILURE);
OPENSSL_free(frag);
return NULL;
}
if (reassembly) {
bitmask = OPENSSL_zalloc(RSMBLY_BITMASK_SIZE(frag_len));
if (bitmask == NULL) {
+ SSLerr(SSL_F_DTLS1_HM_FRAGMENT_NEW, ERR_R_MALLOC_FAILURE);
OPENSSL_free(buf);
OPENSSL_free(frag);
return NULL;
return 0;
}
- *mt = s->s3->tmp.message_type;
+ *mt = s->s3.tmp.message_type;
p = (unsigned char *)s->init_buf->data;
*len = s->init_num;
msg_len += DTLS1_HM_HEADER_LENGTH;
}
+ /*
+ * If receiving Finished, record MAC of prior handshake messages for
+ * Finished verification.
+ */
+ if (*mt == SSL3_MT_FINISHED && !ssl3_take_mac(s)) {
+ /* SSLfatal() already called */
+ return 0;
+ }
+
if (!ssl3_finish_mac(s, p, msg_len))
return 0;
if (s->msg_callback)
/* sanity checking */
if ((frag_off + frag_len) > msg_len
|| msg_len > dtls1_max_handshake_message_len(s)) {
- SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT, SSL_R_EXCESSIVE_MESSAGE_SIZE);
- return SSL_AD_ILLEGAL_PARAMETER;
+ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_DTLS1_PREPROCESS_FRAGMENT,
+ SSL_R_EXCESSIVE_MESSAGE_SIZE);
+ return 0;
}
if (s->d1->r_msg_hdr.frag_off == 0) { /* first fragment */
* dtls_max_handshake_message_len(s) above
*/
if (!BUF_MEM_grow_clean(s->init_buf, msg_len + DTLS1_HM_HEADER_LENGTH)) {
- SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT, ERR_R_BUF_LIB);
- return SSL_AD_INTERNAL_ERROR;
+ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DTLS1_PREPROCESS_FRAGMENT,
+ ERR_R_BUF_LIB);
+ return 0;
}
- s->s3->tmp.message_size = msg_len;
+ s->s3.tmp.message_size = msg_len;
s->d1->r_msg_hdr.msg_len = msg_len;
- s->s3->tmp.message_type = msg_hdr->type;
+ s->s3.tmp.message_type = msg_hdr->type;
s->d1->r_msg_hdr.type = msg_hdr->type;
s->d1->r_msg_hdr.seq = msg_hdr->seq;
} else if (msg_len != s->d1->r_msg_hdr.msg_len) {
* They must be playing with us! BTW, failure to enforce upper limit
* would open possibility for buffer overrun.
*/
- SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT, SSL_R_EXCESSIVE_MESSAGE_SIZE);
- return SSL_AD_ILLEGAL_PARAMETER;
+ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_DTLS1_PREPROCESS_FRAGMENT,
+ SSL_R_EXCESSIVE_MESSAGE_SIZE);
+ return 0;
}
- return 0; /* no error */
+ return 1;
}
+/*
+ * Returns 1 if there is a buffered fragment available, 0 if not, or -1 on a
+ * fatal error.
+ */
static int dtls1_retrieve_buffered_fragment(SSL *s, size_t *len)
{
/*-
*/
pitem *item;
hm_fragment *frag;
- int al;
+ int ret;
do {
item = pqueue_peek(s->d1->buffered_messages);
size_t frag_len = frag->msg_header.frag_len;
pqueue_pop(s->d1->buffered_messages);
- al = dtls1_preprocess_fragment(s, &frag->msg_header);
+ /* Calls SSLfatal() as required */
+ ret = dtls1_preprocess_fragment(s, &frag->msg_header);
- if (al == 0) { /* no alert */
+ if (ret && frag->msg_header.frag_len > 0) {
unsigned char *p =
(unsigned char *)s->init_buf->data + DTLS1_HM_HEADER_LENGTH;
memcpy(&p[frag->msg_header.frag_off], frag->fragment,
dtls1_hm_fragment_free(frag);
pitem_free(item);
- if (al == 0) {
+ if (ret) {
*len = frag_len;
return 1;
}
- ssl3_send_alert(s, SSL3_AL_FATAL, al);
+ /* Fatal error */
s->init_num = 0;
- return 0;
+ return -1;
} else {
return 0;
}
{
unsigned char wire[DTLS1_HM_HEADER_LENGTH];
size_t mlen, frag_off, frag_len;
- int i, al, recvd_type;
+ int i, ret, recvd_type;
struct hm_header_st msg_hdr;
size_t readbytes;
redo:
/* see if we have the required fragment already */
- if (dtls1_retrieve_buffered_fragment(s, &frag_len)) {
+ ret = dtls1_retrieve_buffered_fragment(s, &frag_len);
+ if (ret < 0) {
+ /* SSLfatal() already called */
+ return 0;
+ }
+ if (ret > 0) {
s->init_num = frag_len;
*len = frag_len;
return 1;
}
if (recvd_type == SSL3_RT_CHANGE_CIPHER_SPEC) {
if (wire[0] != SSL3_MT_CCS) {
- al = SSL_AD_UNEXPECTED_MESSAGE;
- SSLerr(SSL_F_DTLS_GET_REASSEMBLED_MESSAGE,
- SSL_R_BAD_CHANGE_CIPHER_SPEC);
+ SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE,
+ SSL_F_DTLS_GET_REASSEMBLED_MESSAGE,
+ SSL_R_BAD_CHANGE_CIPHER_SPEC);
goto f_err;
}
memcpy(s->init_buf->data, wire, readbytes);
s->init_num = readbytes - 1;
s->init_msg = s->init_buf->data + 1;
- s->s3->tmp.message_type = SSL3_MT_CHANGE_CIPHER_SPEC;
- s->s3->tmp.message_size = readbytes - 1;
+ s->s3.tmp.message_type = SSL3_MT_CHANGE_CIPHER_SPEC;
+ s->s3.tmp.message_size = readbytes - 1;
*len = readbytes - 1;
return 1;
}
/* Handshake fails if message header is incomplete */
if (readbytes != DTLS1_HM_HEADER_LENGTH) {
- al = SSL_AD_UNEXPECTED_MESSAGE;
- SSLerr(SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
+ SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE,
+ SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
goto f_err;
}
* Fragments must not span records.
*/
if (frag_len > RECORD_LAYER_get_rrec_length(&s->rlayer)) {
- al = SSL_AD_ILLEGAL_PARAMETER;
- SSLerr(SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, SSL_R_BAD_LENGTH);
+ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
+ SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, SSL_R_BAD_LENGTH);
goto f_err;
}
goto redo;
} else { /* Incorrectly formatted Hello request */
- al = SSL_AD_UNEXPECTED_MESSAGE;
- SSLerr(SSL_F_DTLS_GET_REASSEMBLED_MESSAGE,
- SSL_R_UNEXPECTED_MESSAGE);
+ SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE,
+ SSL_F_DTLS_GET_REASSEMBLED_MESSAGE,
+ SSL_R_UNEXPECTED_MESSAGE);
goto f_err;
}
}
- if ((al = dtls1_preprocess_fragment(s, &msg_hdr)))
+ if (!dtls1_preprocess_fragment(s, &msg_hdr)) {
+ /* SSLfatal() already called */
goto f_err;
+ }
if (frag_len > 0) {
unsigned char *p =
* to fail
*/
if (readbytes != frag_len) {
- al = SSL_AD_ILLEGAL_PARAMETER;
- SSLerr(SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, SSL_R_BAD_LENGTH);
+ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
+ SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, SSL_R_BAD_LENGTH);
goto f_err;
}
return 1;
f_err:
- ssl3_send_alert(s, SSL3_AL_FATAL, al);
s->init_num = 0;
*len = 0;
return 0;
* for these 2 messages, we need to
* ssl->enc_read_ctx re-init
* ssl->rlayer.read_sequence zero
- * ssl->s3->read_mac_secret re-init
+ * ssl->s3.read_mac_secret re-init
* ssl->session->read_sym_enc assign
* ssl->session->read_compression assign
* ssl->session->read_hash assign
s->d1->next_handshake_write_seq++;
if (!WPACKET_put_bytes_u16(pkt, s->d1->handshake_write_seq)) {
- SSLerr(SSL_F_DTLS_CONSTRUCT_CHANGE_CIPHER_SPEC, ERR_R_INTERNAL_ERROR);
- ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
+ SSLfatal(s, SSL_AD_INTERNAL_ERROR,
+ SSL_F_DTLS_CONSTRUCT_CHANGE_CIPHER_SPEC,
+ ERR_R_INTERNAL_ERROR);
+ return 0;
}
}
}
#ifndef OPENSSL_NO_SCTP
+/*
+ * Wait for a dry event. Should only be called at a point in the handshake
+ * where we are not expecting any data from the peer except an alert.
+ */
WORK_STATE dtls_wait_for_dry(SSL *s)
{
- int ret;
+ int ret, errtype;
+ size_t len;
/* read app data until dry event */
ret = BIO_dgram_sctp_wait_for_dry(SSL_get_wbio(s));
- if (ret < 0)
+ if (ret < 0) {
+ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DTLS_WAIT_FOR_DRY,
+ ERR_R_INTERNAL_ERROR);
return WORK_ERROR;
+ }
if (ret == 0) {
- s->s3->in_read_app_data = 2;
+ /*
+ * We're not expecting any more messages from the peer at this point -
+ * but we could get an alert. If an alert is waiting then we will never
+ * return successfully. Therefore we attempt to read a message. This
+ * should never succeed but will process any waiting alerts.
+ */
+ if (dtls_get_reassembled_message(s, &errtype, &len)) {
+ /* The call succeeded! This should never happen */
+ SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_F_DTLS_WAIT_FOR_DRY,
+ SSL_R_UNEXPECTED_MESSAGE);
+ return WORK_ERROR;
+ }
+
+ s->s3.in_read_app_data = 2;
s->rwstate = SSL_READING;
BIO_clear_retry_flags(SSL_get_rbio(s));
BIO_set_retry_read(SSL_get_rbio(s));
int dtls1_read_failed(SSL *s, int code)
{
if (code > 0) {
- SSLerr(SSL_F_DTLS1_READ_FAILED, ERR_R_INTERNAL_ERROR);
- return 1;
+ SSLfatal(s, SSL_AD_INTERNAL_ERROR,
+ SSL_F_DTLS1_READ_FAILED, ERR_R_INTERNAL_ERROR);
+ return 0;
}
- if (!dtls1_is_timer_expired(s)) {
+ if (!dtls1_is_timer_expired(s) || ossl_statem_in_error(s)) {
/*
* not a timeout, none of our business, let higher layers handle
* this. in fact it's probably an error
item = pqueue_find(s->d1->sent_messages, seq64be);
if (item == NULL) {
- SSLerr(SSL_F_DTLS1_RETRANSMIT_MESSAGE, ERR_R_INTERNAL_ERROR);
+ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DTLS1_RETRANSMIT_MESSAGE,
+ ERR_R_INTERNAL_ERROR);
*found = 0;
return 0;
}
projects / openssl.git / blobdiff