kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
248f350ed8
boringssl/ssl/d1_clnt.c

635 lines
17 KiB
C
Raw Normal View History

Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
/*
* DTLS implementation written by Nagendra Modadugu
* (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
*/
/* ====================================================================
* Copyright (c) 1999-2007 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* openssl-core@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
*
*/
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
#include <stdio.h>
#include <openssl/bn.h>
#include <openssl/buf.h>
#include <openssl/dh.h>
#include <openssl/evp.h>
#include <openssl/md5.h>
#include <openssl/mem.h>
#include <openssl/obj.h>
#include <openssl/rand.h>
#include "ssl_locl.h"
static const SSL_METHOD *dtls1_get_client_method(int ver);
static int dtls1_get_hello_verify(SSL *s);
static const SSL_METHOD *dtls1_get_client_method(int ver)
{
Remove SSL_OP_CISCO_ANYCONNECT. I see no internal users and the existence of a THIRD version encoding complicates all version-checking logic. Also convert another version check to SSL_IS_DTLS that was missed earlier. Change-Id: I60d215f57d44880f6e6877889307dc39dbf838f7 Reviewed-on: https://boringssl-review.googlesource.com/1550 Reviewed-by: Adam Langley <agl@google.com>
2014-08-03 18:37:47 +01:00
if (ver == DTLS1_VERSION)
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return(DTLSv1_client_method());
else if (ver == DTLS1_2_VERSION)
return(DTLSv1_2_client_method());
else
return(NULL);
}
IMPLEMENT_dtls1_meth_func(DTLS1_VERSION,
DTLSv1_client_method,
ssl_undefined_function,
dtls1_connect,
dtls1_get_client_method,
DTLSv1_enc_data)
IMPLEMENT_dtls1_meth_func(DTLS1_2_VERSION,
DTLSv1_2_client_method,
ssl_undefined_function,
dtls1_connect,
dtls1_get_client_method,
DTLSv1_2_enc_data)
IMPLEMENT_dtls1_meth_func(DTLS_ANY_VERSION,
DTLS_client_method,
ssl_undefined_function,
dtls1_connect,
dtls1_get_client_method,
DTLSv1_2_enc_data)
int dtls1_connect(SSL *s)
{
BUF_MEM *buf=NULL;
void (*cb)(const SSL *ssl,int type,int val)=NULL;
int ret= -1;
int new_state,state,skip=0;
ERR_clear_error();
ERR_clear_system_error();
if (s->info_callback != NULL)
cb=s->info_callback;
else if (s->ctx->info_callback != NULL)
cb=s->ctx->info_callback;
s->in_handshake++;
if (!SSL_in_init(s) || SSL_in_before(s)) SSL_clear(s);
for (;;)
{
state=s->state;
switch(s->state)
{
case SSL_ST_RENEGOTIATE:
s->renegotiate=1;
s->state=SSL_ST_CONNECT;
s->ctx->stats.sess_connect_renegotiate++;
/* break */
case SSL_ST_BEFORE:
case SSL_ST_CONNECT:
case SSL_ST_BEFORE|SSL_ST_CONNECT:
case SSL_ST_OK|SSL_ST_CONNECT:
s->server=0;
if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_START,1);
Remove SSL_OP_CISCO_ANYCONNECT. I see no internal users and the existence of a THIRD version encoding complicates all version-checking logic. Also convert another version check to SSL_IS_DTLS that was missed earlier. Change-Id: I60d215f57d44880f6e6877889307dc39dbf838f7 Reviewed-on: https://boringssl-review.googlesource.com/1550 Reviewed-by: Adam Langley <agl@google.com>
2014-08-03 18:37:47 +01:00
if ((s->version & 0xff00 ) != (DTLS1_VERSION & 0xff00))
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
{
OPENSSL_PUT_ERROR(SSL, dtls1_connect, ERR_R_INTERNAL_ERROR);
ret = -1;
goto end;
}
/* s->version=SSL3_VERSION; */
s->type=SSL_ST_CONNECT;
if (s->init_buf == NULL)
{
if ((buf=BUF_MEM_new()) == NULL)
{
ret= -1;
goto end;
}
if (!BUF_MEM_grow(buf,SSL3_RT_MAX_PLAIN_LENGTH))
{
ret= -1;
goto end;
}
s->init_buf=buf;
buf=NULL;
}
if (!ssl3_setup_buffers(s)) { ret= -1; goto end; }
/* setup buffing BIO */
if (!ssl_init_wbio_buffer(s,0)) { ret= -1; goto end; }
/* don't push the buffering BIO quite yet */
s->state=SSL3_ST_CW_CLNT_HELLO_A;
s->ctx->stats.sess_connect++;
s->init_num=0;
s->d1->send_cookie = 0;
s->hit = 0;
break;
case SSL3_ST_CW_CLNT_HELLO_A:
case SSL3_ST_CW_CLNT_HELLO_B:
s->shutdown=0;
/* every DTLS ClientHello resets Finished MAC */
ssl3_init_finished_mac(s);
dtls1_start_timer(s);
Rename some message functions for consistency. Make the get/send functions match. ssl3_client_hello -> ssl3_send_client_hello. ssl3_send_newsession_ticket -> ssl3_send_new_session_ticket. ssl3_send_client_verify -> ssl3_send_cert_verify Change-Id: Iea5579479b8a8f392167b8fb3b7e9fe961d0f007 Reviewed-on: https://boringssl-review.googlesource.com/1613 Reviewed-by: Adam Langley <agl@google.com>
2014-08-24 17:03:09 +01:00
ret=ssl3_send_client_hello(s);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (ret <= 0) goto end;
if ( s->d1->send_cookie)
{
s->state=SSL3_ST_CW_FLUSH;
s->s3->tmp.next_state=SSL3_ST_CR_SRVR_HELLO_A;
}
else
Simplify HelloVerifyRequest processing. Rather than switching the order of the ServerHello and HelloVerifyRequest states and processing each twice, have the states follow the protocol order. HelloVerifyRequest reading is optional and ServerHello is strict. Use the send_cookie bit to determine whether we're expecting a cookie or not. Fix the dtls1_stop_timer call in these states to consistently hit the end of a server flight; the previous flight should not be cleared from the retransmit buffer until the entire next flight is received. That said, OpenSSL doesn't appear to implement the part where, on receipt of the previous peer flight, the buffered flight is retransmitted. (With the exception of a SSL3_MT_FINISHED special-case in dtls1_read_bytes.) So if the peer is also OpenSSL, this doesn't do anything. Also fix the DTLS test which wasn't actually asserting that the ClientHello matched. Change-Id: Ia542190972dbffabb837d32c9d453a243caa90b2 Reviewed-on: https://boringssl-review.googlesource.com/1551 Reviewed-by: Adam Langley <agl@google.com>
2014-08-16 06:37:34 +01:00
s->state=DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
s->init_num=0;
/* turn on buffering for the next lot of output */
if (s->bbio != s->wbio)
s->wbio=BIO_push(s->bbio,s->wbio);
break;
Simplify HelloVerifyRequest processing. Rather than switching the order of the ServerHello and HelloVerifyRequest states and processing each twice, have the states follow the protocol order. HelloVerifyRequest reading is optional and ServerHello is strict. Use the send_cookie bit to determine whether we're expecting a cookie or not. Fix the dtls1_stop_timer call in these states to consistently hit the end of a server flight; the previous flight should not be cleared from the retransmit buffer until the entire next flight is received. That said, OpenSSL doesn't appear to implement the part where, on receipt of the previous peer flight, the buffered flight is retransmitted. (With the exception of a SSL3_MT_FINISHED special-case in dtls1_read_bytes.) So if the peer is also OpenSSL, this doesn't do anything. Also fix the DTLS test which wasn't actually asserting that the ClientHello matched. Change-Id: Ia542190972dbffabb837d32c9d453a243caa90b2 Reviewed-on: https://boringssl-review.googlesource.com/1551 Reviewed-by: Adam Langley <agl@google.com>
2014-08-16 06:37:34 +01:00
case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A:
case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B:
ret = dtls1_get_hello_verify(s);
if ( ret <= 0)
goto end;
if ( s->d1->send_cookie)
{
/* start again, with a cookie */
dtls1_stop_timer(s);
s->state = SSL3_ST_CW_CLNT_HELLO_A;
}
else
{
s->state = SSL3_ST_CR_SRVR_HELLO_A;
}
s->init_num = 0;
break;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
case SSL3_ST_CR_SRVR_HELLO_A:
case SSL3_ST_CR_SRVR_HELLO_B:
ret=ssl3_get_server_hello(s);
if (ret <= 0) goto end;
Simplify HelloVerifyRequest processing. Rather than switching the order of the ServerHello and HelloVerifyRequest states and processing each twice, have the states follow the protocol order. HelloVerifyRequest reading is optional and ServerHello is strict. Use the send_cookie bit to determine whether we're expecting a cookie or not. Fix the dtls1_stop_timer call in these states to consistently hit the end of a server flight; the previous flight should not be cleared from the retransmit buffer until the entire next flight is received. That said, OpenSSL doesn't appear to implement the part where, on receipt of the previous peer flight, the buffered flight is retransmitted. (With the exception of a SSL3_MT_FINISHED special-case in dtls1_read_bytes.) So if the peer is also OpenSSL, this doesn't do anything. Also fix the DTLS test which wasn't actually asserting that the ClientHello matched. Change-Id: Ia542190972dbffabb837d32c9d453a243caa90b2 Reviewed-on: https://boringssl-review.googlesource.com/1551 Reviewed-by: Adam Langley <agl@google.com>
2014-08-16 06:37:34 +01:00
if (s->hit)
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
{
Simplify HelloVerifyRequest processing. Rather than switching the order of the ServerHello and HelloVerifyRequest states and processing each twice, have the states follow the protocol order. HelloVerifyRequest reading is optional and ServerHello is strict. Use the send_cookie bit to determine whether we're expecting a cookie or not. Fix the dtls1_stop_timer call in these states to consistently hit the end of a server flight; the previous flight should not be cleared from the retransmit buffer until the entire next flight is received. That said, OpenSSL doesn't appear to implement the part where, on receipt of the previous peer flight, the buffered flight is retransmitted. (With the exception of a SSL3_MT_FINISHED special-case in dtls1_read_bytes.) So if the peer is also OpenSSL, this doesn't do anything. Also fix the DTLS test which wasn't actually asserting that the ClientHello matched. Change-Id: Ia542190972dbffabb837d32c9d453a243caa90b2 Reviewed-on: https://boringssl-review.googlesource.com/1551 Reviewed-by: Adam Langley <agl@google.com>
2014-08-16 06:37:34 +01:00
s->state=SSL3_ST_CR_FINISHED_A;
if (s->tlsext_ticket_expected)
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
{
Simplify HelloVerifyRequest processing. Rather than switching the order of the ServerHello and HelloVerifyRequest states and processing each twice, have the states follow the protocol order. HelloVerifyRequest reading is optional and ServerHello is strict. Use the send_cookie bit to determine whether we're expecting a cookie or not. Fix the dtls1_stop_timer call in these states to consistently hit the end of a server flight; the previous flight should not be cleared from the retransmit buffer until the entire next flight is received. That said, OpenSSL doesn't appear to implement the part where, on receipt of the previous peer flight, the buffered flight is retransmitted. (With the exception of a SSL3_MT_FINISHED special-case in dtls1_read_bytes.) So if the peer is also OpenSSL, this doesn't do anything. Also fix the DTLS test which wasn't actually asserting that the ClientHello matched. Change-Id: Ia542190972dbffabb837d32c9d453a243caa90b2 Reviewed-on: https://boringssl-review.googlesource.com/1551 Reviewed-by: Adam Langley <agl@google.com>
2014-08-16 06:37:34 +01:00
/* receive renewed session ticket */
s->state=SSL3_ST_CR_SESSION_TICKET_A;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
}
else
Simplify HelloVerifyRequest processing. Rather than switching the order of the ServerHello and HelloVerifyRequest states and processing each twice, have the states follow the protocol order. HelloVerifyRequest reading is optional and ServerHello is strict. Use the send_cookie bit to determine whether we're expecting a cookie or not. Fix the dtls1_stop_timer call in these states to consistently hit the end of a server flight; the previous flight should not be cleared from the retransmit buffer until the entire next flight is received. That said, OpenSSL doesn't appear to implement the part where, on receipt of the previous peer flight, the buffered flight is retransmitted. (With the exception of a SSL3_MT_FINISHED special-case in dtls1_read_bytes.) So if the peer is also OpenSSL, this doesn't do anything. Also fix the DTLS test which wasn't actually asserting that the ClientHello matched. Change-Id: Ia542190972dbffabb837d32c9d453a243caa90b2 Reviewed-on: https://boringssl-review.googlesource.com/1551 Reviewed-by: Adam Langley <agl@google.com>
2014-08-16 06:37:34 +01:00
{
s->state=SSL3_ST_CR_CERT_A;
}
s->init_num=0;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
break;
case SSL3_ST_CR_CERT_A:
case SSL3_ST_CR_CERT_B:
Update d1_clnt.c to use ssl_cipher_has_server_public_key. Mirror the changes in s3_clnt.c. Change-Id: I7af7080c6eea2a67cc994befa11e45d32eaa9615 Reviewed-on: https://boringssl-review.googlesource.com/1506 Reviewed-by: Adam Langley <agl@google.com>
2014-08-13 20:08:33 +01:00
if (ssl_cipher_has_server_public_key(s->s3->tmp.new_cipher))
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
{
ret=ssl3_get_server_certificate(s);
if (ret <= 0) goto end;
Client-side OCSP stapling support. Remove the old implementation which was excessively general. This mirrors the SCT support and adds a single boolean flag to request an OCSP response with no responder IDs, extensions, or frills. The response, if received, is stored on the SSL_SESSION so that it is available for (re)validation on session resumption; Chromium revalidates the saved auth parameters on resume. Server support is unimplemented for now. This API will also need to be adjusted in the future if we implement RFC 6961. Change-Id: I533c029b7f7ea622d814d05f934fdace2da85cb1 Reviewed-on: https://boringssl-review.googlesource.com/1671 Reviewed-by: Adam Langley <agl@google.com>
2014-08-27 21:42:38 +01:00
if (s->s3->tmp.certificate_status_expected)
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
s->state=SSL3_ST_CR_CERT_STATUS_A;
else
s->state=SSL3_ST_CR_KEY_EXCH_A;
}
else
{
skip = 1;
s->state=SSL3_ST_CR_KEY_EXCH_A;
}
s->init_num=0;
break;
case SSL3_ST_CR_KEY_EXCH_A:
case SSL3_ST_CR_KEY_EXCH_B:
Rename ssl3_get_key_exchange to ssl3_get_server_key_exchange. More consistent with ssl3_send_server_key_exchange and the message name. Change-Id: If0f435a89bdf117297d349099708fff0bd5a6e98 Reviewed-on: https://boringssl-review.googlesource.com/1170 Reviewed-by: Adam Langley <agl@google.com>
2014-07-15 00:14:46 +01:00
ret=ssl3_get_server_key_exchange(s);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (ret <= 0) goto end;
s->state=SSL3_ST_CR_CERT_REQ_A;
s->init_num=0;
/* at this point we check that we have the
* required stuff from the server */
if (!ssl3_check_cert_and_algorithm(s))
{
ret= -1;
goto end;
}
break;
case SSL3_ST_CR_CERT_REQ_A:
case SSL3_ST_CR_CERT_REQ_B:
ret=ssl3_get_certificate_request(s);
if (ret <= 0) goto end;
s->state=SSL3_ST_CR_SRVR_DONE_A;
s->init_num=0;
break;
case SSL3_ST_CR_SRVR_DONE_A:
case SSL3_ST_CR_SRVR_DONE_B:
ret=ssl3_get_server_done(s);
if (ret <= 0) goto end;
dtls1_stop_timer(s);
if (s->s3->tmp.cert_req)
s->s3->tmp.next_state=SSL3_ST_CW_CERT_A;
else
s->s3->tmp.next_state=SSL3_ST_CW_KEY_EXCH_A;
s->init_num=0;
s->state=s->s3->tmp.next_state;
break;
case SSL3_ST_CW_CERT_A:
case SSL3_ST_CW_CERT_B:
case SSL3_ST_CW_CERT_C:
case SSL3_ST_CW_CERT_D:
dtls1_start_timer(s);
ret=ssl3_send_client_certificate(s);
if (ret <= 0) goto end;
s->state=SSL3_ST_CW_KEY_EXCH_A;
s->init_num=0;
break;
case SSL3_ST_CW_KEY_EXCH_A:
case SSL3_ST_CW_KEY_EXCH_B:
dtls1_start_timer(s);
ret=ssl3_send_client_key_exchange(s);
if (ret <= 0) goto end;
/* For TLS, cert_req is set to 2, so a cert chain
* of nothing is sent, but no verify packet is sent */
if (s->s3->tmp.cert_req == 1)
{
s->state=SSL3_ST_CW_CERT_VRFY_A;
}
else
{
s->state=SSL3_ST_CW_CHANGE_A;
s->s3->change_cipher_spec=0;
}
s->init_num=0;
break;
case SSL3_ST_CW_CERT_VRFY_A:
case SSL3_ST_CW_CERT_VRFY_B:
dtls1_start_timer(s);
Rename some message functions for consistency. Make the get/send functions match. ssl3_client_hello -> ssl3_send_client_hello. ssl3_send_newsession_ticket -> ssl3_send_new_session_ticket. ssl3_send_client_verify -> ssl3_send_cert_verify Change-Id: Iea5579479b8a8f392167b8fb3b7e9fe961d0f007 Reviewed-on: https://boringssl-review.googlesource.com/1613 Reviewed-by: Adam Langley <agl@google.com>
2014-08-24 17:03:09 +01:00
ret=ssl3_send_cert_verify(s);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (ret <= 0) goto end;
s->state=SSL3_ST_CW_CHANGE_A;
s->init_num=0;
s->s3->change_cipher_spec=0;
break;
case SSL3_ST_CW_CHANGE_A:
case SSL3_ST_CW_CHANGE_B:
if (!s->hit)
dtls1_start_timer(s);
ret=dtls1_send_change_cipher_spec(s,
SSL3_ST_CW_CHANGE_A,SSL3_ST_CW_CHANGE_B);
if (ret <= 0) goto end;
s->state=SSL3_ST_CW_FINISHED_A;
s->init_num=0;
s->session->cipher=s->s3->tmp.new_cipher;
if (!s->method->ssl3_enc->setup_key_block(s))
{
ret= -1;
goto end;
}
if (!s->method->ssl3_enc->change_cipher_state(s,
SSL3_CHANGE_CIPHER_CLIENT_WRITE))
{
ret= -1;
goto end;
}
dtls1_reset_seq_numbers(s, SSL3_CC_WRITE);
break;
case SSL3_ST_CW_FINISHED_A:
case SSL3_ST_CW_FINISHED_B:
if (!s->hit)
dtls1_start_timer(s);
ret=ssl3_send_finished(s,
SSL3_ST_CW_FINISHED_A,SSL3_ST_CW_FINISHED_B,
s->method->ssl3_enc->client_finished_label,
s->method->ssl3_enc->client_finished_label_len);
if (ret <= 0) goto end;
s->state=SSL3_ST_CW_FLUSH;
if (s->hit)
{
s->s3->tmp.next_state=SSL_ST_OK;
}
else
{
/* Allow NewSessionTicket if ticket expected */
if (s->tlsext_ticket_expected)
s->s3->tmp.next_state=SSL3_ST_CR_SESSION_TICKET_A;
else
s->s3->tmp.next_state=SSL3_ST_CR_FINISHED_A;
}
s->init_num=0;
break;
case SSL3_ST_CR_SESSION_TICKET_A:
case SSL3_ST_CR_SESSION_TICKET_B:
ret=ssl3_get_new_session_ticket(s);
if (ret <= 0) goto end;
s->state=SSL3_ST_CR_FINISHED_A;
s->init_num=0;
break;
case SSL3_ST_CR_CERT_STATUS_A:
case SSL3_ST_CR_CERT_STATUS_B:
ret=ssl3_get_cert_status(s);
if (ret <= 0) goto end;
s->state=SSL3_ST_CR_KEY_EXCH_A;
s->init_num=0;
break;
case SSL3_ST_CR_FINISHED_A:
case SSL3_ST_CR_FINISHED_B:
s->d1->change_cipher_spec_ok = 1;
ret=ssl3_get_finished(s,SSL3_ST_CR_FINISHED_A,
SSL3_ST_CR_FINISHED_B);
if (ret <= 0) goto end;
dtls1_stop_timer(s);
if (s->hit)
s->state=SSL3_ST_CW_CHANGE_A;
else
s->state=SSL_ST_OK;
s->init_num=0;
break;
case SSL3_ST_CW_FLUSH:
s->rwstate=SSL_WRITING;
if (BIO_flush(s->wbio) <= 0)
{
/* If the write error was fatal, stop trying */
if (!BIO_should_retry(s->wbio))
{
s->rwstate=SSL_NOTHING;
s->state=s->s3->tmp.next_state;
}
ret= -1;
goto end;
}
s->rwstate=SSL_NOTHING;
s->state=s->s3->tmp.next_state;
break;
case SSL_ST_OK:
/* clean a few things up */
ssl3_cleanup_key_block(s);
#if 0
if (s->init_buf != NULL)
{
BUF_MEM_free(s->init_buf);
s->init_buf=NULL;
}
#endif
Remove SSL3_FLAGS_POP_BUFFER. This is an experimental flag that dates back to SSLeay 0.8.1b or earlier. It's never set internally and never set in consumers. Change-Id: I922583635c9f3d8d93f08f1707531ad22a26ae6a Reviewed-on: https://boringssl-review.googlesource.com/2214 Reviewed-by: Adam Langley <agl@google.com>
2014-11-05 06:28:53 +00:00
/* Remove write buffering now. */
ssl_free_wbio_buffer(s);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
s->init_num=0;
s->renegotiate=0;
s->new_session=0;
ssl_update_cache(s,SSL_SESS_CACHE_CLIENT);
if (s->hit) s->ctx->stats.sess_hit++;
ret=1;
/* s->server=0; */
s->handshake_func=dtls1_connect;
s->ctx->stats.sess_connect_good++;
if (cb != NULL) cb(s,SSL_CB_HANDSHAKE_DONE,1);
/* done with handshaking */
s->d1->handshake_read_seq = 0;
s->d1->next_handshake_write_seq = 0;
goto end;
/* break; */
default:
OPENSSL_PUT_ERROR(SSL, dtls1_connect, SSL_R_UNKNOWN_STATE);
ret= -1;
goto end;
/* break; */
}
/* did we do anything */
if (!s->s3->tmp.reuse_message && !skip)
{
if (s->debug)
{
if ((ret=BIO_flush(s->wbio)) <= 0)
goto end;
}
if ((cb != NULL) && (s->state != state))
{
new_state=s->state;
s->state=state;
cb(s,SSL_CB_CONNECT_LOOP,1);
s->state=new_state;
}
}
skip=0;
}
end:
s->in_handshake--;
if (buf != NULL)
BUF_MEM_free(buf);
if (cb != NULL)
cb(s,SSL_CB_CONNECT_EXIT,ret);
return(ret);
}
static int dtls1_get_hello_verify(SSL *s)
{
Port dtls1_get_hello_verify to CBS. Gives bounds checks and asserts that there's nothing after the cookie. Change-Id: I8f9753e0c72670e9960f73a5722cefd9c02696a9 Reviewed-on: https://boringssl-review.googlesource.com/1507 Reviewed-by: Adam Langley <agl@google.com>
2014-08-13 20:13:57 +01:00
long n;
int al, ok = 0;
CBS hello_verify_request, cookie;
uint16_t server_version;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
s->first_packet = 1;
n=s->method->ssl_get_message(s,
DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A,
DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B,
-1,
Simplify HelloVerifyRequest processing. Rather than switching the order of the ServerHello and HelloVerifyRequest states and processing each twice, have the states follow the protocol order. HelloVerifyRequest reading is optional and ServerHello is strict. Use the send_cookie bit to determine whether we're expecting a cookie or not. Fix the dtls1_stop_timer call in these states to consistently hit the end of a server flight; the previous flight should not be cleared from the retransmit buffer until the entire next flight is received. That said, OpenSSL doesn't appear to implement the part where, on receipt of the previous peer flight, the buffered flight is retransmitted. (With the exception of a SSL3_MT_FINISHED special-case in dtls1_read_bytes.) So if the peer is also OpenSSL, this doesn't do anything. Also fix the DTLS test which wasn't actually asserting that the ClientHello matched. Change-Id: Ia542190972dbffabb837d32c9d453a243caa90b2 Reviewed-on: https://boringssl-review.googlesource.com/1551 Reviewed-by: Adam Langley <agl@google.com>
2014-08-16 06:37:34 +01:00
/* Use the same maximum size as ssl3_get_server_hello. */
20000,
Introduce a hash_message parameter to ssl_get_message. This replaces the special-case in ssl3_get_message for Channel ID. Also add ssl3_hash_current_message to hash the current message, taking TLS vs DTLS handshake header size into account. One subtlety with this flag is that a message intended to be processed with SSL_GET_MESSAGE_DONT_HASH_MESSAGE cannot follow an optional message (reprocessed with reuse_message, etc.). There is an assertion to that effect. If need be, we can loosen it to requiring that the preceeding optional message also pass SSL_GET_MESSAGE_DONT_HASH_MESSAGE and then maintain some state to perform the more accurate assertion, but this is sufficient for now. Change-Id: If8c87342b291ac041a35885b9b5ee961aee86eab Reviewed-on: https://boringssl-review.googlesource.com/1630 Reviewed-by: Adam Langley <agl@google.com>
2014-08-26 02:34:56 +01:00
SSL_GET_MESSAGE_HASH_MESSAGE,
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
&ok);
s->first_packet = 0;
if (!ok) return((int)n);
if (s->s3->tmp.message_type != DTLS1_MT_HELLO_VERIFY_REQUEST)
{
s->d1->send_cookie = 0;
Simplify HelloVerifyRequest processing. Rather than switching the order of the ServerHello and HelloVerifyRequest states and processing each twice, have the states follow the protocol order. HelloVerifyRequest reading is optional and ServerHello is strict. Use the send_cookie bit to determine whether we're expecting a cookie or not. Fix the dtls1_stop_timer call in these states to consistently hit the end of a server flight; the previous flight should not be cleared from the retransmit buffer until the entire next flight is received. That said, OpenSSL doesn't appear to implement the part where, on receipt of the previous peer flight, the buffered flight is retransmitted. (With the exception of a SSL3_MT_FINISHED special-case in dtls1_read_bytes.) So if the peer is also OpenSSL, this doesn't do anything. Also fix the DTLS test which wasn't actually asserting that the ClientHello matched. Change-Id: Ia542190972dbffabb837d32c9d453a243caa90b2 Reviewed-on: https://boringssl-review.googlesource.com/1551 Reviewed-by: Adam Langley <agl@google.com>
2014-08-16 06:37:34 +01:00
s->s3->tmp.reuse_message = 1;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return(1);
}
Port dtls1_get_hello_verify to CBS. Gives bounds checks and asserts that there's nothing after the cookie. Change-Id: I8f9753e0c72670e9960f73a5722cefd9c02696a9 Reviewed-on: https://boringssl-review.googlesource.com/1507 Reviewed-by: Adam Langley <agl@google.com>
2014-08-13 20:13:57 +01:00
CBS_init(&hello_verify_request, s->init_msg, n);
if (!CBS_get_u16(&hello_verify_request, &server_version) ||
!CBS_get_u8_length_prefixed(&hello_verify_request, &cookie) ||
CBS_len(&hello_verify_request) != 0)
{
al = SSL_AD_DECODE_ERROR;
OPENSSL_PUT_ERROR(SSL, ssl3_get_cert_status, SSL_R_DECODE_ERROR);
goto f_err;
}
if (CBS_len(&cookie) > sizeof(s->d1->cookie))
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
{
al=SSL_AD_ILLEGAL_PARAMETER;
goto f_err;
}
Port dtls1_get_hello_verify to CBS. Gives bounds checks and asserts that there's nothing after the cookie. Change-Id: I8f9753e0c72670e9960f73a5722cefd9c02696a9 Reviewed-on: https://boringssl-review.googlesource.com/1507 Reviewed-by: Adam Langley <agl@google.com>
2014-08-13 20:13:57 +01:00
memcpy(s->d1->cookie, CBS_data(&cookie), CBS_len(&cookie));
s->d1->cookie_len = CBS_len(&cookie);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
s->d1->send_cookie = 1;
return 1;
f_err:
ssl3_send_alert(s, SSL3_AL_FATAL, al);
return -1;
}
Reference in New Issue Copy Permalink