diff options
Diffstat (limited to 'deps/openssl/openssl/ssl/statem/statem_dtls.c')
| -rw-r--r-- | deps/openssl/openssl/ssl/statem/statem_dtls.c | 428 |
1 files changed, 244 insertions, 184 deletions
diff --git a/deps/openssl/openssl/ssl/statem/statem_dtls.c b/deps/openssl/openssl/ssl/statem/statem_dtls.c index 5b34425445..b016fa7cff 100644 --- a/deps/openssl/openssl/ssl/statem/statem_dtls.c +++ b/deps/openssl/openssl/ssl/statem/statem_dtls.c @@ -12,6 +12,7 @@ #include <stdio.h> #include "../ssl_locl.h" #include "statem_locl.h" +#include "internal/cryptlib.h" #include <openssl/buffer.h> #include <openssl/objects.h> #include <openssl/evp.h> @@ -32,7 +33,6 @@ #define RSMBLY_BITMASK_IS_COMPLETE(bitmask, msg_len, is_complete) { \ long ii; \ - OPENSSL_assert((msg_len) > 0); \ is_complete = 1; \ if (bitmask[(((msg_len) - 1) >> 3)] != bitmask_end_values[((msg_len) & 7)]) is_complete = 0; \ if (is_complete) for (ii = (((msg_len) - 1) >> 3) - 1; ii >= 0 ; ii--) \ @@ -43,30 +43,30 @@ static unsigned char bitmask_start_values[] = static unsigned char bitmask_end_values[] = { 0xff, 0x01, 0x03, 0x07, 0x0f, 0x1f, 0x3f, 0x7f }; -static void dtls1_fix_message_header(SSL *s, unsigned long frag_off, - unsigned long frag_len); +static void dtls1_fix_message_header(SSL *s, size_t frag_off, + size_t frag_len); static unsigned char *dtls1_write_message_header(SSL *s, unsigned char *p); static void dtls1_set_message_header_int(SSL *s, unsigned char mt, - unsigned long len, + size_t len, unsigned short seq_num, - unsigned long frag_off, - unsigned long frag_len); -static int dtls_get_reassembled_message(SSL *s, long *len); + size_t frag_off, + size_t frag_len); +static int dtls_get_reassembled_message(SSL *s, int *errtype, size_t *len); -static hm_fragment *dtls1_hm_fragment_new(unsigned long frag_len, - int reassembly) +static hm_fragment *dtls1_hm_fragment_new(size_t frag_len, int reassembly) { hm_fragment *frag = NULL; unsigned char *buf = NULL; unsigned char *bitmask = NULL; - frag = OPENSSL_malloc(sizeof(*frag)); - if (frag == NULL) + if ((frag = OPENSSL_malloc(sizeof(*frag))) == NULL) { + SSLerr(SSL_F_DTLS1_HM_FRAGMENT_NEW, ERR_R_MALLOC_FAILURE); return NULL; + } if (frag_len) { - buf = OPENSSL_malloc(frag_len); - if (buf == NULL) { + if ((buf = OPENSSL_malloc(frag_len)) == NULL) { + SSLerr(SSL_F_DTLS1_HM_FRAGMENT_NEW, ERR_R_MALLOC_FAILURE); OPENSSL_free(frag); return NULL; } @@ -79,6 +79,7 @@ static hm_fragment *dtls1_hm_fragment_new(unsigned long frag_len, if (reassembly) { bitmask = OPENSSL_zalloc(RSMBLY_BITMASK_SIZE(frag_len)); if (bitmask == NULL) { + SSLerr(SSL_F_DTLS1_HM_FRAGMENT_NEW, ERR_R_MALLOC_FAILURE); OPENSSL_free(buf); OPENSSL_free(frag); return NULL; @@ -111,9 +112,10 @@ void dtls1_hm_fragment_free(hm_fragment *frag) int dtls1_do_write(SSL *s, int type) { int ret; - unsigned int curr_mtu; + size_t written; + size_t curr_mtu; int retry = 1; - unsigned int len, frag_off, mac_size, blocksize, used_len; + size_t len, frag_off, mac_size, blocksize, used_len; if (!dtls1_query_mtu(s)) return -1; @@ -122,9 +124,11 @@ int dtls1_do_write(SSL *s, int type) /* should have something reasonable now */ return -1; - if (s->init_off == 0 && type == SSL3_RT_HANDSHAKE) - OPENSSL_assert(s->init_num == - (int)s->d1->w_msg_hdr.msg_len + DTLS1_HM_HEADER_LENGTH); + if (s->init_off == 0 && type == SSL3_RT_HANDSHAKE) { + if (!ossl_assert(s->init_num == + s->d1->w_msg_hdr.msg_len + DTLS1_HM_HEADER_LENGTH)) + return -1; + } if (s->write_hash) { if (s->enc_write_ctx @@ -235,7 +239,8 @@ int dtls1_do_write(SSL *s, int type) data[s->init_off]); } - ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off], len); + ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off], len, + &written); if (ret < 0) { /* * might need to update MTU here, but we don't know which @@ -253,7 +258,7 @@ int dtls1_do_write(SSL *s, int type) } else return -1; } else { - return (-1); + return -1; } } else { @@ -261,7 +266,8 @@ int dtls1_do_write(SSL *s, int type) * bad if this assert fails, only part of the handshake message * got sent. but why would this happen? */ - OPENSSL_assert(len == (unsigned int)ret); + if (!ossl_assert(len == written)) + return -1; if (type == SSL3_RT_HANDSHAKE && !s->d1->retransmitting) { /* @@ -271,7 +277,7 @@ int dtls1_do_write(SSL *s, int type) unsigned char *p = (unsigned char *)&s->init_buf->data[s->init_off]; const struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr; - int xlen; + size_t xlen; if (frag_off == 0 && s->version != DTLS1_BAD_VER) { /* @@ -284,17 +290,17 @@ int dtls1_do_write(SSL *s, int type) l2n3(0, p); l2n3(msg_hdr->msg_len, p); p -= DTLS1_HM_HEADER_LENGTH; - xlen = ret; + xlen = written; } else { p += DTLS1_HM_HEADER_LENGTH; - xlen = ret - DTLS1_HM_HEADER_LENGTH; + xlen = written - DTLS1_HM_HEADER_LENGTH; } if (!ssl3_finish_mac(s, p, xlen)) return -1; } - if (ret == s->init_num) { + if (written == s->init_num) { if (s->msg_callback) s->msg_callback(1, s->version, type, s->init_buf->data, (size_t)(s->init_off + s->init_num), s, @@ -303,12 +309,12 @@ int dtls1_do_write(SSL *s, int type) s->init_off = 0; /* done writing this message */ s->init_num = 0; - return (1); + return 1; } - s->init_off += ret; - s->init_num -= ret; - ret -= DTLS1_HM_HEADER_LENGTH; - frag_off += ret; + s->init_off += written; + s->init_num -= written; + written -= DTLS1_HM_HEADER_LENGTH; + frag_off += written; /* * We save the fragment offset for the next fragment so we have it @@ -319,32 +325,34 @@ int dtls1_do_write(SSL *s, int type) dtls1_fix_message_header(s, frag_off, 0); } } - return (0); + return 0; } -int dtls_get_message(SSL *s, int *mt, unsigned long *len) +int dtls_get_message(SSL *s, int *mt, size_t *len) { struct hm_header_st *msg_hdr; unsigned char *p; - unsigned long msg_len; - int ok; - long tmplen; + size_t msg_len; + size_t tmplen; + int errtype; msg_hdr = &s->d1->r_msg_hdr; memset(msg_hdr, 0, sizeof(*msg_hdr)); again: - ok = dtls_get_reassembled_message(s, &tmplen); - if (tmplen == DTLS1_HM_BAD_FRAGMENT || tmplen == DTLS1_HM_FRAGMENT_RETRY) { - /* bad fragment received */ - goto again; - } else if (tmplen <= 0 && !ok) { + if (!dtls_get_reassembled_message(s, &errtype, &tmplen)) { + if (errtype == DTLS1_HM_BAD_FRAGMENT + || errtype == DTLS1_HM_FRAGMENT_RETRY) { + /* bad fragment received */ + goto again; + } return 0; } *mt = s->s3->tmp.message_type; p = (unsigned char *)s->init_buf->data; + *len = s->init_num; if (*mt == SSL3_MT_CHANGE_CIPHER_SPEC) { if (s->msg_callback) { @@ -354,7 +362,6 @@ int dtls_get_message(SSL *s, int *mt, unsigned long *len) /* * This isn't a real handshake message so skip the processing below. */ - *len = (unsigned long)tmplen; return 1; } @@ -391,7 +398,6 @@ int dtls_get_message(SSL *s, int *mt, unsigned long *len) s->d1->handshake_read_seq++; s->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH; - *len = s->init_num; return 1; } @@ -401,11 +407,10 @@ int dtls_get_message(SSL *s, int *mt, unsigned long *len) * permitted in a DTLS handshake message for |s|. The minimum is 16KB, but * may be greater if the maximum certificate list size requires it. */ -static unsigned long dtls1_max_handshake_message_len(const SSL *s) +static size_t dtls1_max_handshake_message_len(const SSL *s) { - unsigned long max_len = - DTLS1_HM_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH; - if (max_len < (unsigned long)s->max_cert_list) + size_t max_len = DTLS1_HM_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH; + if (max_len < s->max_cert_list) return s->max_cert_list; return max_len; } @@ -421,8 +426,9 @@ static int dtls1_preprocess_fragment(SSL *s, struct hm_header_st *msg_hdr) /* sanity checking */ if ((frag_off + frag_len) > msg_len || msg_len > dtls1_max_handshake_message_len(s)) { - SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT, SSL_R_EXCESSIVE_MESSAGE_SIZE); - return SSL_AD_ILLEGAL_PARAMETER; + SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_DTLS1_PREPROCESS_FRAGMENT, + SSL_R_EXCESSIVE_MESSAGE_SIZE); + return 0; } if (s->d1->r_msg_hdr.frag_off == 0) { /* first fragment */ @@ -431,8 +437,9 @@ static int dtls1_preprocess_fragment(SSL *s, struct hm_header_st *msg_hdr) * dtls_max_handshake_message_len(s) above */ if (!BUF_MEM_grow_clean(s->init_buf, msg_len + DTLS1_HM_HEADER_LENGTH)) { - SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT, ERR_R_BUF_LIB); - return SSL_AD_INTERNAL_ERROR; + SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DTLS1_PREPROCESS_FRAGMENT, + ERR_R_BUF_LIB); + return 0; } s->s3->tmp.message_size = msg_len; @@ -445,14 +452,19 @@ static int dtls1_preprocess_fragment(SSL *s, struct hm_header_st *msg_hdr) * They must be playing with us! BTW, failure to enforce upper limit * would open possibility for buffer overrun. */ - SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT, SSL_R_EXCESSIVE_MESSAGE_SIZE); - return SSL_AD_ILLEGAL_PARAMETER; + SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_DTLS1_PREPROCESS_FRAGMENT, + SSL_R_EXCESSIVE_MESSAGE_SIZE); + return 0; } - return 0; /* no error */ + return 1; } -static int dtls1_retrieve_buffered_fragment(SSL *s, int *ok) +/* + * Returns 1 if there is a buffered fragment available, 0 if not, or -1 on a + * fatal error. + */ +static int dtls1_retrieve_buffered_fragment(SSL *s, size_t *len) { /*- * (0) check whether the desired fragment is available @@ -462,9 +474,7 @@ static int dtls1_retrieve_buffered_fragment(SSL *s, int *ok) */ pitem *item; hm_fragment *frag; - int al; - - *ok = 0; + int ret; do { item = pqueue_peek(s->d1->buffered_messages); @@ -488,13 +498,13 @@ static int dtls1_retrieve_buffered_fragment(SSL *s, int *ok) return 0; if (s->d1->handshake_read_seq == frag->msg_header.seq) { - unsigned long frag_len = frag->msg_header.frag_len; + size_t frag_len = frag->msg_header.frag_len; pqueue_pop(s->d1->buffered_messages); - al = dtls1_preprocess_fragment(s, &frag->msg_header); + /* Calls SSLfatal() as required */ + ret = dtls1_preprocess_fragment(s, &frag->msg_header); - /* al will be 0 if no alert */ - if (al == 0 && frag->msg_header.frag_len > 0) { + if (ret && frag->msg_header.frag_len > 0) { unsigned char *p = (unsigned char *)s->init_buf->data + DTLS1_HM_HEADER_LENGTH; memcpy(&p[frag->msg_header.frag_off], frag->fragment, @@ -504,34 +514,36 @@ static int dtls1_retrieve_buffered_fragment(SSL *s, int *ok) dtls1_hm_fragment_free(frag); pitem_free(item); - if (al == 0) { - *ok = 1; - return frag_len; + if (ret) { + *len = frag_len; + return 1; } - ssl3_send_alert(s, SSL3_AL_FATAL, al); + /* Fatal error */ s->init_num = 0; - *ok = 0; return -1; - } else + } else { return 0; + } } static int -dtls1_reassemble_fragment(SSL *s, const struct hm_header_st *msg_hdr, int *ok) +dtls1_reassemble_fragment(SSL *s, const struct hm_header_st *msg_hdr) { hm_fragment *frag = NULL; pitem *item = NULL; int i = -1, is_complete; unsigned char seq64be[8]; - unsigned long frag_len = msg_hdr->frag_len; + size_t frag_len = msg_hdr->frag_len; + size_t readbytes; if ((msg_hdr->frag_off + frag_len) > msg_hdr->msg_len || msg_hdr->msg_len > dtls1_max_handshake_message_len(s)) goto err; - if (frag_len == 0) + if (frag_len == 0) { return DTLS1_HM_FRAGMENT_RETRY; + } /* Try to find item in queue */ memset(seq64be, 0, sizeof(seq64be)); @@ -568,10 +580,10 @@ dtls1_reassemble_fragment(SSL *s, const struct hm_header_st *msg_hdr, int *ok) devnull, frag_len > sizeof(devnull) ? sizeof(devnull) : - frag_len, 0); + frag_len, 0, &readbytes); if (i <= 0) goto err; - frag_len -= i; + frag_len -= readbytes; } return DTLS1_HM_FRAGMENT_RETRY; } @@ -579,8 +591,8 @@ dtls1_reassemble_fragment(SSL *s, const struct hm_header_st *msg_hdr, int *ok) /* read the body of the fragment (header has already been read */ i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, NULL, frag->fragment + msg_hdr->frag_off, - frag_len, 0); - if ((unsigned long)i != frag_len) + frag_len, 0, &readbytes); + if (i <= 0 || readbytes != frag_len) i = -1; if (i <= 0) goto err; @@ -588,6 +600,8 @@ dtls1_reassemble_fragment(SSL *s, const struct hm_header_st *msg_hdr, int *ok) RSMBLY_BITMASK_MARK(frag->reassembly, (long)msg_hdr->frag_off, (long)(msg_hdr->frag_off + frag_len)); + if (!ossl_assert(msg_hdr->msg_len > 0)) + goto err; RSMBLY_BITMASK_IS_COMPLETE(frag->reassembly, (long)msg_hdr->msg_len, is_complete); @@ -610,7 +624,8 @@ dtls1_reassemble_fragment(SSL *s, const struct hm_header_st *msg_hdr, int *ok) * would have returned it and control would never have reached this * branch. */ - OPENSSL_assert(item != NULL); + if (!ossl_assert(item != NULL)) + goto err; } return DTLS1_HM_FRAGMENT_RETRY; @@ -618,19 +633,18 @@ dtls1_reassemble_fragment(SSL *s, const struct hm_header_st *msg_hdr, int *ok) err: if (item == NULL) dtls1_hm_fragment_free(frag); - *ok = 0; - return i; + return -1; } static int -dtls1_process_out_of_seq_message(SSL *s, const struct hm_header_st *msg_hdr, - int *ok) +dtls1_process_out_of_seq_message(SSL *s, const struct hm_header_st *msg_hdr) { int i = -1; hm_fragment *frag = NULL; pitem *item = NULL; unsigned char seq64be[8]; - unsigned long frag_len = msg_hdr->frag_len; + size_t frag_len = msg_hdr->frag_len; + size_t readbytes; if ((msg_hdr->frag_off + frag_len) > msg_hdr->msg_len) goto err; @@ -663,14 +677,15 @@ dtls1_process_out_of_seq_message(SSL *s, const struct hm_header_st *msg_hdr, devnull, frag_len > sizeof(devnull) ? sizeof(devnull) : - frag_len, 0); + frag_len, 0, &readbytes); if (i <= 0) goto err; - frag_len -= i; + frag_len -= readbytes; } } else { - if (frag_len != msg_hdr->msg_len) - return dtls1_reassemble_fragment(s, msg_hdr, ok); + if (frag_len != msg_hdr->msg_len) { + return dtls1_reassemble_fragment(s, msg_hdr); + } if (frag_len > dtls1_max_handshake_message_len(s)) goto err; @@ -686,8 +701,9 @@ dtls1_process_out_of_seq_message(SSL *s, const struct hm_header_st *msg_hdr, * read the body of the fragment (header has already been read */ i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, NULL, - frag->fragment, frag_len, 0); - if ((unsigned long)i != frag_len) + frag->fragment, frag_len, 0, + &readbytes); + if (i<=0 || readbytes != frag_len) i = -1; if (i <= 0) goto err; @@ -706,7 +722,8 @@ dtls1_process_out_of_seq_message(SSL *s, const struct hm_header_st *msg_hdr, * have been processed with |dtls1_reassemble_fragment|, above, or * the record will have been discarded. */ - OPENSSL_assert(item != NULL); + if (!ossl_assert(item != NULL)) + goto err; } return DTLS1_HM_FRAGMENT_RETRY; @@ -714,56 +731,61 @@ dtls1_process_out_of_seq_message(SSL *s, const struct hm_header_st *msg_hdr, err: if (item == NULL) dtls1_hm_fragment_free(frag); - *ok = 0; - return i; + return 0; } -static int dtls_get_reassembled_message(SSL *s, long *len) +static int dtls_get_reassembled_message(SSL *s, int *errtype, size_t *len) { unsigned char wire[DTLS1_HM_HEADER_LENGTH]; - unsigned long mlen, frag_off, frag_len; - int i, al, recvd_type; + size_t mlen, frag_off, frag_len; + int i, ret, recvd_type; struct hm_header_st msg_hdr; - int ok; + size_t readbytes; + + *errtype = 0; redo: /* see if we have the required fragment already */ - if ((frag_len = dtls1_retrieve_buffered_fragment(s, &ok)) || ok) { - if (ok) - s->init_num = frag_len; + ret = dtls1_retrieve_buffered_fragment(s, &frag_len); + if (ret < 0) { + /* SSLfatal() already called */ + return 0; + } + if (ret > 0) { + s->init_num = frag_len; *len = frag_len; - return ok; + return 1; } /* read handshake message header */ i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, &recvd_type, wire, - DTLS1_HM_HEADER_LENGTH, 0); + DTLS1_HM_HEADER_LENGTH, 0, &readbytes); if (i <= 0) { /* nbio, or an error */ s->rwstate = SSL_READING; - *len = i; + *len = 0; return 0; } if (recvd_type == SSL3_RT_CHANGE_CIPHER_SPEC) { if (wire[0] != SSL3_MT_CCS) { - al = SSL_AD_UNEXPECTED_MESSAGE; - SSLerr(SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, - SSL_R_BAD_CHANGE_CIPHER_SPEC); + SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, + SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, + SSL_R_BAD_CHANGE_CIPHER_SPEC); goto f_err; } - memcpy(s->init_buf->data, wire, i); - s->init_num = i - 1; + memcpy(s->init_buf->data, wire, readbytes); + s->init_num = readbytes - 1; s->init_msg = s->init_buf->data + 1; s->s3->tmp.message_type = SSL3_MT_CHANGE_CIPHER_SPEC; - s->s3->tmp.message_size = i - 1; - *len = i - 1; + s->s3->tmp.message_size = readbytes - 1; + *len = readbytes - 1; return 1; } /* Handshake fails if message header is incomplete */ - if (i != DTLS1_HM_HEADER_LENGTH) { - al = SSL_AD_UNEXPECTED_MESSAGE; - SSLerr(SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE); + if (readbytes != DTLS1_HM_HEADER_LENGTH) { + SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, + SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE); goto f_err; } @@ -779,8 +801,8 @@ static int dtls_get_reassembled_message(SSL *s, long *len) * Fragments must not span records. */ if (frag_len > RECORD_LAYER_get_rrec_length(&s->rlayer)) { - al = SSL3_AD_ILLEGAL_PARAMETER; - SSLerr(SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, SSL_R_BAD_LENGTH); + SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, + SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, SSL_R_BAD_LENGTH); goto f_err; } @@ -791,17 +813,19 @@ static int dtls_get_reassembled_message(SSL *s, long *len) * although we're still expecting seq 0 (ClientHello) */ if (msg_hdr.seq != s->d1->handshake_read_seq) { - *len = dtls1_process_out_of_seq_message(s, &msg_hdr, &ok); - return ok; + *errtype = dtls1_process_out_of_seq_message(s, &msg_hdr); + return 0; } if (frag_len && frag_len < mlen) { - *len = dtls1_reassemble_fragment(s, &msg_hdr, &ok); - return ok; + *errtype = dtls1_reassemble_fragment(s, &msg_hdr); + return 0; } - if (!s->server && s->d1->r_msg_hdr.frag_off == 0 && - wire[0] == SSL3_MT_HELLO_REQUEST) { + if (!s->server + && s->d1->r_msg_hdr.frag_off == 0 + && s->statem.hand_state != TLS_ST_OK + && wire[0] == SSL3_MT_HELLO_REQUEST) { /* * The server may always send 'Hello Request' messages -- we are * doing a handshake anyway now, so ignore them if their format is @@ -817,22 +841,24 @@ static int dtls_get_reassembled_message(SSL *s, long *len) goto redo; } else { /* Incorrectly formatted Hello request */ - al = SSL_AD_UNEXPECTED_MESSAGE; - SSLerr(SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, - SSL_R_UNEXPECTED_MESSAGE); + SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, + SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, + SSL_R_UNEXPECTED_MESSAGE); goto f_err; } } - if ((al = dtls1_preprocess_fragment(s, &msg_hdr))) + if (!dtls1_preprocess_fragment(s, &msg_hdr)) { + /* SSLfatal() already called */ goto f_err; + } if (frag_len > 0) { unsigned char *p = (unsigned char *)s->init_buf->data + DTLS1_HM_HEADER_LENGTH; i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, NULL, - &p[frag_off], frag_len, 0); + &p[frag_off], frag_len, 0, &readbytes); /* * This shouldn't ever fail due to NBIO because we already checked @@ -840,19 +866,20 @@ static int dtls_get_reassembled_message(SSL *s, long *len) */ if (i <= 0) { s->rwstate = SSL_READING; - *len = i; + *len = 0; return 0; } - } else - i = 0; + } else { + readbytes = 0; + } /* * XDTLS: an incorrectly formatted fragment should cause the handshake * to fail */ - if (i != (int)frag_len) { - al = SSL3_AD_ILLEGAL_PARAMETER; - SSLerr(SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, SSL3_AD_ILLEGAL_PARAMETER); + if (readbytes != frag_len) { + SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, + SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, SSL_R_BAD_LENGTH); goto f_err; } @@ -866,9 +893,8 @@ static int dtls_get_reassembled_message(SSL *s, long *len) return 1; f_err: - ssl3_send_alert(s, SSL3_AL_FATAL, al); s->init_num = 0; - *len = -1; + *len = 0; return 0; } @@ -881,30 +907,17 @@ static int dtls_get_reassembled_message(SSL *s, long *len) * ssl->session->read_compression assign * ssl->session->read_hash assign */ -int dtls_construct_change_cipher_spec(SSL *s) +int dtls_construct_change_cipher_spec(SSL *s, WPACKET *pkt) { - unsigned char *p; - - p = (unsigned char *)s->init_buf->data; - *p++ = SSL3_MT_CCS; - s->d1->handshake_write_seq = s->d1->next_handshake_write_seq; - s->init_num = DTLS1_CCS_HEADER_LENGTH; - if (s->version == DTLS1_BAD_VER) { s->d1->next_handshake_write_seq++; - s2n(s->d1->handshake_write_seq, p); - s->init_num += 2; - } - s->init_off = 0; - - dtls1_set_message_header_int(s, SSL3_MT_CCS, 0, - s->d1->handshake_write_seq, 0, 0); - - /* buffer the message to handle re-xmits */ - if (!dtls1_buffer_message(s, 1)) { - SSLerr(SSL_F_DTLS_CONSTRUCT_CHANGE_CIPHER_SPEC, ERR_R_INTERNAL_ERROR); - return 0; + if (!WPACKET_put_bytes_u16(pkt, s->d1->handshake_write_seq)) { + SSLfatal(s, SSL_AD_INTERNAL_ERROR, + SSL_F_DTLS_CONSTRUCT_CHANGE_CIPHER_SPEC, + ERR_R_INTERNAL_ERROR); + return 0; + } } return 1; @@ -913,17 +926,20 @@ int dtls_construct_change_cipher_spec(SSL *s) #ifndef OPENSSL_NO_SCTP /* * Wait for a dry event. Should only be called at a point in the handshake - * where we are not expecting any data from the peer (except possibly an alert). + * where we are not expecting any data from the peer except an alert. */ WORK_STATE dtls_wait_for_dry(SSL *s) { - int ret; - long len; + int ret, errtype; + size_t len; /* read app data until dry event */ ret = BIO_dgram_sctp_wait_for_dry(SSL_get_wbio(s)); - if (ret < 0) + if (ret < 0) { + SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DTLS_WAIT_FOR_DRY, + ERR_R_INTERNAL_ERROR); return WORK_ERROR; + } if (ret == 0) { /* @@ -932,11 +948,10 @@ WORK_STATE dtls_wait_for_dry(SSL *s) * return successfully. Therefore we attempt to read a message. This * should never succeed but will process any waiting alerts. */ - if (dtls_get_reassembled_message(s, &len)) { + if (dtls_get_reassembled_message(s, &errtype, &len)) { /* The call succeeded! This should never happen */ - SSLerr(SSL_F_DTLS_WAIT_FOR_DRY, SSL_R_UNEXPECTED_MESSAGE); - ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); - ossl_statem_set_error(s); + SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_F_DTLS_WAIT_FOR_DRY, + SSL_R_UNEXPECTED_MESSAGE); return WORK_ERROR; } @@ -953,24 +968,20 @@ WORK_STATE dtls_wait_for_dry(SSL *s) int dtls1_read_failed(SSL *s, int code) { if (code > 0) { - SSLerr(SSL_F_DTLS1_READ_FAILED, ERR_R_INTERNAL_ERROR); - return 1; + SSLfatal(s, SSL_AD_INTERNAL_ERROR, + SSL_F_DTLS1_READ_FAILED, ERR_R_INTERNAL_ERROR); + return 0; } - if (!dtls1_is_timer_expired(s)) { + if (!dtls1_is_timer_expired(s) || ossl_statem_in_error(s)) { /* * not a timeout, none of our business, let higher layers handle * this. in fact it's probably an error */ return code; } -#ifndef OPENSSL_NO_HEARTBEATS - /* done, no need to send a retransmit */ - if (!SSL_in_init(s) && !s->tlsext_hb_pending) -#else /* done, no need to send a retransmit */ if (!SSL_in_init(s)) -#endif { BIO_set_flags(SSL_get_rbio(s), BIO_FLAGS_READ); return code; @@ -1026,7 +1037,8 @@ int dtls1_buffer_message(SSL *s, int is_ccs) * this function is called immediately after a message has been * serialized */ - OPENSSL_assert(s->init_off == 0); + if (!ossl_assert(s->init_off == 0)) + return 0; frag = dtls1_hm_fragment_new(s->init_num, 0); if (frag == NULL) @@ -1036,13 +1048,15 @@ int dtls1_buffer_message(SSL *s, int is_ccs) if (is_ccs) { /* For DTLS1_BAD_VER the header length is non-standard */ - OPENSSL_assert(s->d1->w_msg_hdr.msg_len + - ((s->version == - DTLS1_BAD_VER) ? 3 : DTLS1_CCS_HEADER_LENGTH) - == (unsigned int)s->init_num); + if (!ossl_assert(s->d1->w_msg_hdr.msg_len + + ((s->version == + DTLS1_BAD_VER) ? 3 : DTLS1_CCS_HEADER_LENGTH) + == (unsigned int)s->init_num)) + return 0; } else { - OPENSSL_assert(s->d1->w_msg_hdr.msg_len + - DTLS1_HM_HEADER_LENGTH == (unsigned int)s->init_num); + if (!ossl_assert(s->d1->w_msg_hdr.msg_len + + DTLS1_HM_HEADER_LENGTH == (unsigned int)s->init_num)) + return 0; } frag->msg_header.msg_len = s->d1->w_msg_hdr.msg_len; @@ -1090,11 +1104,6 @@ int dtls1_retransmit_message(SSL *s, unsigned short seq, int *found) unsigned char seq64be[8]; struct dtls1_retransmit_state saved_state; - /*- - OPENSSL_assert(s->init_num == 0); - OPENSSL_assert(s->init_off == 0); - */ - /* XDTLS: the requested message ought to be found, otherwise error */ memset(seq64be, 0, sizeof(seq64be)); seq64be[6] = (unsigned char)(seq >> 8); @@ -1102,7 +1111,8 @@ int dtls1_retransmit_message(SSL *s, unsigned short seq, int *found) item = pqueue_find(s->d1->sent_messages, seq64be); if (item == NULL) { - SSLerr(SSL_F_DTLS1_RETRANSMIT_MESSAGE, ERR_R_INTERNAL_ERROR); + SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DTLS1_RETRANSMIT_MESSAGE, + ERR_R_INTERNAL_ERROR); *found = 0; return 0; } @@ -1159,8 +1169,8 @@ int dtls1_retransmit_message(SSL *s, unsigned short seq, int *found) } void dtls1_set_message_header(SSL *s, - unsigned char mt, unsigned long len, - unsigned long frag_off, unsigned long frag_len) + unsigned char mt, size_t len, + size_t frag_off, size_t frag_len) { if (frag_off == 0) { s->d1->handshake_write_seq = s->d1->next_handshake_write_seq; @@ -1174,8 +1184,8 @@ void dtls1_set_message_header(SSL *s, /* don't actually do the writing, wait till the MTU has been retrieved */ static void dtls1_set_message_header_int(SSL *s, unsigned char mt, - unsigned long len, unsigned short seq_num, - unsigned long frag_off, unsigned long frag_len) + size_t len, unsigned short seq_num, + size_t frag_off, size_t frag_len) { struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr; @@ -1187,7 +1197,7 @@ dtls1_set_message_header_int(SSL *s, unsigned char mt, } static void -dtls1_fix_message_header(SSL *s, unsigned long frag_off, unsigned long frag_len) +dtls1_fix_message_header(SSL *s, size_t frag_off, size_t frag_len) { struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr; @@ -1219,3 +1229,53 @@ void dtls1_get_message_header(unsigned char *data, struct hm_header_st *msg_hdr) n2l3(data, msg_hdr->frag_off); n2l3(data, msg_hdr->frag_len); } + +int dtls1_set_handshake_header(SSL *s, WPACKET *pkt, int htype) +{ + unsigned char *header; + + if (htype == SSL3_MT_CHANGE_CIPHER_SPEC) { + s->d1->handshake_write_seq = s->d1->next_handshake_write_seq; + dtls1_set_message_header_int(s, SSL3_MT_CCS, 0, + s->d1->handshake_write_seq, 0, 0); + if (!WPACKET_put_bytes_u8(pkt, SSL3_MT_CCS)) + return 0; + } else { + dtls1_set_message_header(s, htype, 0, 0, 0); + /* + * We allocate space at the start for the message header. This gets + * filled in later + */ + if (!WPACKET_allocate_bytes(pkt, DTLS1_HM_HEADER_LENGTH, &header) + || !WPACKET_start_sub_packet(pkt)) + return 0; + } + + return 1; +} + +int dtls1_close_construct_packet(SSL *s, WPACKET *pkt, int htype) +{ + size_t msglen; + + if ((htype != SSL3_MT_CHANGE_CIPHER_SPEC && !WPACKET_close(pkt)) + || !WPACKET_get_length(pkt, &msglen) + || msglen > INT_MAX) + return 0; + + if (htype != SSL3_MT_CHANGE_CIPHER_SPEC) { + s->d1->w_msg_hdr.msg_len = msglen - DTLS1_HM_HEADER_LENGTH; + s->d1->w_msg_hdr.frag_len = msglen - DTLS1_HM_HEADER_LENGTH; + } + s->init_num = (int)msglen; + s->init_off = 0; + + if (htype != DTLS1_MT_HELLO_VERIFY_REQUEST) { + /* Buffer the message to handle re-xmits */ + if (!dtls1_buffer_message(s, htype == SSL3_MT_CHANGE_CIPHER_SPEC + ? 1 : 0)) + return 0; + } + + return 1; +} |