kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
3e51757de2
boringssl/ssl/d1_pkt.c

420 lines
14 KiB
C
Raw Normal View History

Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
/* DTLS implementation written by Nagendra Modadugu
* (nagendra@cs.stanford.edu) for the OpenSSL project 2005. */
/* ====================================================================
* Copyright (c) 1998-2005 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* openssl-core@openssl.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com).
*
*/
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.] */
Align the SSL stack on #include style. ssl.h should be first. Also two lines after includes and the rest of the file. Change-Id: Icb7586e00a3e64170082c96cf3f8bfbb2b7e1611 Reviewed-on: https://boringssl-review.googlesource.com/5892 Reviewed-by: Adam Langley <agl@google.com>
2015-09-15 06:48:04 +01:00
#include <openssl/ssl.h>
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
#include <assert.h>
Include-what-you-use ssl/internal.h. The rest of ssl/ still includes things everywhere, but this at least fixes the includes that were implicit from ssl/internal.h. Change-Id: I7ed22590aca0fe78af84fd99a3e557f4b05f6782 Reviewed-on: https://boringssl-review.googlesource.com/4281 Reviewed-by: Adam Langley <agl@google.com>
2015-04-08 04:05:04 +01:00
#include <string.h>
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Tidy up the DTLS code's blocking-mode retransmits. Move this logic out of dtls1_read_bytes and into dtls1_get_record. Only trigger it when reading from the buffer fails. The other one shouldn't be necessary. This exists to handle the blocking BIO case when the BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT signal triggers, so we only need to do it when timeouts actually trigger. There also doesn't seem to be a need for most of the machinery. The BIO_set_flags call seems to be working around a deficiency in the underlying BIO. There also shouldn't be a need to check the handshake state as there wouldn't be a timer to restart otherwise. Change-Id: Ic901ccfb5b82aeb409d16a9d32c04741410ad6d7 Reviewed-on: https://boringssl-review.googlesource.com/8122 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-05-11 01:51:34 +01:00
#include <openssl/bio.h>
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
#include <openssl/buf.h>
Don't use dtls1_read_bytes to read messages. This was probably the worst offender of them all as read_bytes is the wrong abstraction to begin with. Note this is a slight change in how processing a record works. Rather than reading one fragment at a time, we process all fragments in a record and return. The intent here is so that all records are processed atomically since the connection eventually will not be able to retain a buffer holding the record. This loses a ton of (though not quite all yet) those a2b macros. Change-Id: Ibe4bbcc33c496328de08d272457d2282c411b38b Reviewed-on: https://boringssl-review.googlesource.com/8176 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 21:38:35 +01:00
#include <openssl/bytestring.h>
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
#include <openssl/mem.h>
#include <openssl/evp.h>
#include <openssl/err.h>
#include <openssl/rand.h>
Rename ssl_locl.h to internal.h Match the other internal headers. Change-Id: Iff7e2dd06a1a7bf993053d0464cc15638ace3aaa Reviewed-on: https://boringssl-review.googlesource.com/4280 Reviewed-by: Adam Langley <agl@google.com>
2015-04-08 03:38:30 +01:00
#include "internal.h"
Reformatting of several DTLS source files. This change has no semantic effect (I hope!). It's just a reformatting of a few files in ssl/. This is just a start – the other files in ssl/ should follow in the coming days. Change-Id: I5eb3f4b18d0d46349d0f94d3fe5ab2003db5364e
2014-12-14 00:28:18 +00:00
Don't use dtls1_read_bytes to read messages. This was probably the worst offender of them all as read_bytes is the wrong abstraction to begin with. Note this is a slight change in how processing a record works. Rather than reading one fragment at a time, we process all fragments in a record and return. The intent here is so that all records are processed atomically since the connection eventually will not be able to retain a buffer holding the record. This loses a ton of (though not quite all yet) those a2b macros. Change-Id: Ibe4bbcc33c496328de08d272457d2282c411b38b Reviewed-on: https://boringssl-review.googlesource.com/8176 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 21:38:35 +01:00
int dtls1_get_record(SSL *ssl) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
again:
Tidy up shutdown state. The existing logic gets confused in a number of cases around close_notify vs. fatal alert. SSL_shutdown, while still pushing to the error queue, will fail to notice alerts. We also get confused if we try to send a fatal alert when we've already sent something else. Change-Id: I9b1d217fbf1ee8a9c59efbebba60165b7de9689e Reviewed-on: https://boringssl-review.googlesource.com/7952 Reviewed-by: David Benjamin <davidben@google.com>
2016-05-10 22:03:10 +01:00
switch (ssl->s3->recv_shutdown) {
case ssl_shutdown_none:
break;
case ssl_shutdown_fatal_alert:
OPENSSL_PUT_ERROR(SSL, SSL_R_PROTOCOL_IS_SHUTDOWN);
return -1;
case ssl_shutdown_close_notify:
Consolidate SSL_RECEIVED_SHUTDOWN checks. SSL_RECEIVED_SHUTDOWN checks in the record layer happen in two different places. Some operations (but not all) check it, and so does read_bytes. Move it to get_record. This check should be at a low-level since it is otherwise duplicated in every operation. It is also a signal which originates from around the peer's record layer, so it makes sense to check it near the same code. (This one's in get_record which is technically lower-level than read_bytes, but we're trying to get rid of read_bytes. They're very coupled functions.) Also, if we've seen a fatal alert, replay an error, not an EOF. Change-Id: Idec35c5068ddabe5b1a9145016d8f945da2421cf Reviewed-on: https://boringssl-review.googlesource.com/7436 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-10 06:15:15 +00:00
return 0;
}
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
/* Read a new packet if there is no unconsumed one. */
if (ssl_read_buffer_len(ssl) == 0) {
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
int read_ret = ssl_read_buffer_extend_to(ssl, 0 /* unused */);
if (read_ret < 0 && dtls1_is_timer_expired(ssl)) {
Tidy up the DTLS code's blocking-mode retransmits. Move this logic out of dtls1_read_bytes and into dtls1_get_record. Only trigger it when reading from the buffer fails. The other one shouldn't be necessary. This exists to handle the blocking BIO case when the BIO_CTRL_DGRAM_SET_NEXT_TIMEOUT signal triggers, so we only need to do it when timeouts actually trigger. There also doesn't seem to be a need for most of the machinery. The BIO_set_flags call seems to be working around a deficiency in the underlying BIO. There also shouldn't be a need to check the handshake state as there wouldn't be a timer to restart otherwise. Change-Id: Ic901ccfb5b82aeb409d16a9d32c04741410ad6d7 Reviewed-on: https://boringssl-review.googlesource.com/8122 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-05-11 01:51:34 +01:00
/* For blocking BIOs, retransmits must be handled internally. */
int timeout_ret = DTLSv1_handle_timeout(ssl);
if (timeout_ret <= 0) {
return timeout_ret;
}
goto again;
}
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
if (read_ret <= 0) {
return read_ret;
Reformatting of several DTLS source files. This change has no semantic effect (I hope!). It's just a reformatting of a few files in ssl/. This is just a start – the other files in ssl/ should follow in the coming days. Change-Id: I5eb3f4b18d0d46349d0f94d3fe5ab2003db5364e
2014-12-14 00:28:18 +00:00
}
}
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
assert(ssl_read_buffer_len(ssl) > 0);
Reformatting of several DTLS source files. This change has no semantic effect (I hope!). It's just a reformatting of a few files in ssl/. This is just a start – the other files in ssl/ should follow in the coming days. Change-Id: I5eb3f4b18d0d46349d0f94d3fe5ab2003db5364e
2014-12-14 00:28:18 +00:00
Make tls_open_record always in-place. The business with ssl_record_prefix_len is rather a hassle. Instead, have tls_open_record always decrypt in-place and give back a CBS to where the body is. This way the caller doesn't need to do an extra check all to avoid creating an invalid pointer and underflow in subtraction. Change-Id: I4e12b25a760870d8f8a503673ab00a2d774fc9ee Reviewed-on: https://boringssl-review.googlesource.com/8173 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-06 23:54:51 +01:00
CBS body;
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
uint8_t type, alert;
Make tls_open_record always in-place. The business with ssl_record_prefix_len is rather a hassle. Instead, have tls_open_record always decrypt in-place and give back a CBS to where the body is. This way the caller doesn't need to do an extra check all to avoid creating an invalid pointer and underflow in subtraction. Change-Id: I4e12b25a760870d8f8a503673ab00a2d774fc9ee Reviewed-on: https://boringssl-review.googlesource.com/8173 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-06 23:54:51 +01:00
size_t consumed;
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
enum ssl_open_record_t open_ret =
Make tls_open_record always in-place. The business with ssl_record_prefix_len is rather a hassle. Instead, have tls_open_record always decrypt in-place and give back a CBS to where the body is. This way the caller doesn't need to do an extra check all to avoid creating an invalid pointer and underflow in subtraction. Change-Id: I4e12b25a760870d8f8a503673ab00a2d774fc9ee Reviewed-on: https://boringssl-review.googlesource.com/8173 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-06 23:54:51 +01:00
dtls_open_record(ssl, &type, &body, &consumed, &alert,
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
ssl_read_buffer(ssl), ssl_read_buffer_len(ssl));
ssl_read_buffer_consume(ssl, consumed);
switch (open_ret) {
case ssl_open_record_partial:
/* Impossible in DTLS. */
break;
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
case ssl_open_record_success:
Make tls_open_record always in-place. The business with ssl_record_prefix_len is rather a hassle. Instead, have tls_open_record always decrypt in-place and give back a CBS to where the body is. This way the caller doesn't need to do an extra check all to avoid creating an invalid pointer and underflow in subtraction. Change-Id: I4e12b25a760870d8f8a503673ab00a2d774fc9ee Reviewed-on: https://boringssl-review.googlesource.com/8173 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-06 23:54:51 +01:00
if (CBS_len(&body) > 0xffff) {
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW);
return -1;
}
Fold dtls1_process_record into dtls1_get_record. The split was only needed for buffering records. Likewise, the extra seq_num field is now unnecessary. This also fixes a bug where dtls1_process_record will push an error on the queue if the decrypted record is too large, which dtls1_get_record will ignore but fail to clear, leaving garbage on the error queue. The error is now treated as fatal; the reason DTLS silently drops invalid packets is worrying about ease of DoS, but after SSL_AEAD_CTX_open, the packet has been authenticated. (Unless it's the null cipher, but that's during the handshake and the handshake is already DoS-able by breaking handshake reassembly state.) The function is still rather a mess. Later changes will clean this up. BUG=468889 Change-Id: I96a54afe0755d43c34456f76e77fc4ee52ad01e3 Reviewed-on: https://boringssl-review.googlesource.com/5557 Reviewed-by: Adam Langley <agl@google.com>
2015-07-25 20:22:17 +01:00
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
SSL3_RECORD *rr = &ssl->s3->rrec;
rr->type = type;
Make tls_open_record always in-place. The business with ssl_record_prefix_len is rather a hassle. Instead, have tls_open_record always decrypt in-place and give back a CBS to where the body is. This way the caller doesn't need to do an extra check all to avoid creating an invalid pointer and underflow in subtraction. Change-Id: I4e12b25a760870d8f8a503673ab00a2d774fc9ee Reviewed-on: https://boringssl-review.googlesource.com/8173 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-06 23:54:51 +01:00
rr->length = (uint16_t)CBS_len(&body);
rr->data = (uint8_t *)CBS_data(&body);
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
return 1;
Fold dtls1_process_record into dtls1_get_record. The split was only needed for buffering records. Likewise, the extra seq_num field is now unnecessary. This also fixes a bug where dtls1_process_record will push an error on the queue if the decrypted record is too large, which dtls1_get_record will ignore but fail to clear, leaving garbage on the error queue. The error is now treated as fatal; the reason DTLS silently drops invalid packets is worrying about ease of DoS, but after SSL_AEAD_CTX_open, the packet has been authenticated. (Unless it's the null cipher, but that's during the handshake and the handshake is already DoS-able by breaking handshake reassembly state.) The function is still rather a mess. Later changes will clean this up. BUG=468889 Change-Id: I96a54afe0755d43c34456f76e77fc4ee52ad01e3 Reviewed-on: https://boringssl-review.googlesource.com/5557 Reviewed-by: Adam Langley <agl@google.com>
2015-07-25 20:22:17 +01:00
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
case ssl_open_record_discard:
goto again;
Fold dtls1_process_record into dtls1_get_record. The split was only needed for buffering records. Likewise, the extra seq_num field is now unnecessary. This also fixes a bug where dtls1_process_record will push an error on the queue if the decrypted record is too large, which dtls1_get_record will ignore but fail to clear, leaving garbage on the error queue. The error is now treated as fatal; the reason DTLS silently drops invalid packets is worrying about ease of DoS, but after SSL_AEAD_CTX_open, the packet has been authenticated. (Unless it's the null cipher, but that's during the handshake and the handshake is already DoS-able by breaking handshake reassembly state.) The function is still rather a mess. Later changes will clean this up. BUG=468889 Change-Id: I96a54afe0755d43c34456f76e77fc4ee52ad01e3 Reviewed-on: https://boringssl-review.googlesource.com/5557 Reviewed-by: Adam Langley <agl@google.com>
2015-07-25 20:22:17 +01:00
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
case ssl_open_record_close_notify:
return 0;
case ssl_open_record_fatal_alert:
return -1;
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
case ssl_open_record_error:
ssl3_send_alert(ssl, SSL3_AL_FATAL, alert);
return -1;
Fold dtls1_process_record into dtls1_get_record. The split was only needed for buffering records. Likewise, the extra seq_num field is now unnecessary. This also fixes a bug where dtls1_process_record will push an error on the queue if the decrypted record is too large, which dtls1_get_record will ignore but fail to clear, leaving garbage on the error queue. The error is now treated as fatal; the reason DTLS silently drops invalid packets is worrying about ease of DoS, but after SSL_AEAD_CTX_open, the packet has been authenticated. (Unless it's the null cipher, but that's during the handshake and the handshake is already DoS-able by breaking handshake reassembly state.) The function is still rather a mess. Later changes will clean this up. BUG=468889 Change-Id: I96a54afe0755d43c34456f76e77fc4ee52ad01e3 Reviewed-on: https://boringssl-review.googlesource.com/5557 Reviewed-by: Adam Langley <agl@google.com>
2015-07-25 20:22:17 +01:00
}
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
assert(0);
OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
return -1;
Reformatting of several DTLS source files. This change has no semantic effect (I hope!). It's just a reformatting of a few files in ssl/. This is just a start – the other files in ssl/ should follow in the coming days. Change-Id: I5eb3f4b18d0d46349d0f94d3fe5ab2003db5364e
2014-12-14 00:28:18 +00:00
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Move post-handshake message handling out of read_app_data. This finishes getting rid of ssl_read_bytes! Now we have separate entry-points for the various cases. For now, I've kept TLS handshake consuming records partially. When we do the BIO-less API, I expect that will need to change, since we won't have the record buffer available. (Instead, the ssl3_read_handshake_bytes and extend_handshake_buffer pair will look more like the DTLS side or Go and pull the entire record into init_buf.) This change opts to make read_app_data drive the message to completion in anticipation of DTLS 1.3. That hasn't been specified, but NewSessionTicket certainly will exist. Knowing that DTLS necessarily has interleave seems something better suited for the SSL_PROTOCOL_METHOD internals to drive. It needs refining, but SSL_PROTOCOL_METHOD is now actually a half-decent abstraction boundary between the higher-level protocol logic and DTLS/TLS-specific record-layer and message dispatchy bits. BUG=83 Change-Id: I9b4626bb8a29d9cb30174d9e6912bb420ed45aff Reviewed-on: https://boringssl-review.googlesource.com/9001 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-28 16:05:58 +01:00
int dtls1_read_app_data(SSL *ssl, int *out_got_handshake, uint8_t *buf, int len,
int peek) {
Move implicit handshake driving out of read_bytes. This removes the final use of in_handshake. Note that there is still a rentrant call of read_bytes -> handshake_func when we see a HelloRequest. That will need to be signaled up to ssl_read_impl separately out of read_app_data. Change-Id: I823de243f75e6b73eb40c6cf44157b4fc21eb8fb Reviewed-on: https://boringssl-review.googlesource.com/7439 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-10 06:28:00 +00:00
assert(!SSL_in_init(ssl));
Remove dtls1_read_bytes. It can be folded into dtls1_read_app_data. This code, since it still takes an output pointer, does not yet process records atomically. (Though, being DTLS, it probably should...) Change-Id: I57d60785c9c1dd13b5b2ed158a08a8f5a518db4f Reviewed-on: https://boringssl-review.googlesource.com/8177 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 01:49:50 +01:00
Move post-handshake message handling out of read_app_data. This finishes getting rid of ssl_read_bytes! Now we have separate entry-points for the various cases. For now, I've kept TLS handshake consuming records partially. When we do the BIO-less API, I expect that will need to change, since we won't have the record buffer available. (Instead, the ssl3_read_handshake_bytes and extend_handshake_buffer pair will look more like the DTLS side or Go and pull the entire record into init_buf.) This change opts to make read_app_data drive the message to completion in anticipation of DTLS 1.3. That hasn't been specified, but NewSessionTicket certainly will exist. Knowing that DTLS necessarily has interleave seems something better suited for the SSL_PROTOCOL_METHOD internals to drive. It needs refining, but SSL_PROTOCOL_METHOD is now actually a half-decent abstraction boundary between the higher-level protocol logic and DTLS/TLS-specific record-layer and message dispatchy bits. BUG=83 Change-Id: I9b4626bb8a29d9cb30174d9e6912bb420ed45aff Reviewed-on: https://boringssl-review.googlesource.com/9001 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-28 16:05:58 +01:00
*out_got_handshake = 0;
Remove dtls1_read_bytes. It can be folded into dtls1_read_app_data. This code, since it still takes an output pointer, does not yet process records atomically. (Though, being DTLS, it probably should...) Change-Id: I57d60785c9c1dd13b5b2ed158a08a8f5a518db4f Reviewed-on: https://boringssl-review.googlesource.com/8177 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 01:49:50 +01:00
SSL3_RECORD *rr = &ssl->s3->rrec;
again:
if (rr->length == 0) {
int ret = dtls1_get_record(ssl);
if (ret <= 0) {
return ret;
}
}
if (rr->type == SSL3_RT_HANDSHAKE) {
/* Parse the first fragment header to determine if this is a pre-CCS or
* post-CCS handshake record. DTLS resets handshake message numbers on each
* handshake, so renegotiations and retransmissions are ambiguous. */
CBS cbs, body;
struct hm_header_st msg_hdr;
CBS_init(&cbs, rr->data, rr->length);
if (!dtls1_parse_fragment(&cbs, &msg_hdr, &body)) {
ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_HANDSHAKE_RECORD);
return -1;
}
Reject stray post-Finished messages in DTLS. This is in preparation for switching finish_handshake to a release_current_message hook. finish_handshake in DTLS is also responsible for releasing any memory associated with extra messages in the handshake. Except that's not right and we need to make it an error anyway. Given that the rest of the DTLS dispatch layer already strongly assumes there is only one message in epoch one, putting the check in the fragment processing works fine enough. Add tests for this. This will certainly need revising when DTLS 1.3 happens (perhaps just a version check, perhaps bringing finish_handshake back as a function that can fail... which means we need a state just before SSL_ST_OK), but DTLS 1.3 post-handshake messages haven't really been written down, so let's do the easy thing for now and add a test for when it gets more interesting. This removes the sequence number reset in the DTLS code. That reset never did anything becase we don't and never will renego. We should make sure DTLS 1.3 does not bring the reset back for post-handshake stuff. (It was wrong in 1.2 too. Penultimate-flight retransmits and renego requests are ambiguous in DTLS.) BUG=83 Change-Id: I33d645a8550f73e74606030b9815fdac0c9fb682 Reviewed-on: https://boringssl-review.googlesource.com/8988 Reviewed-by: Adam Langley <agl@google.com>
2016-07-27 22:40:37 +01:00
if (msg_hdr.type == SSL3_MT_FINISHED &&
Switch finish_handshake to release_current_message. With the previous DTLS change, the dispatch layer only cares about the end of the handshake to know when to drop the current message. TLS 1.3 post-handshake messages will need a similar hook, so convert it to this lower-level one. BUG=83 Change-Id: I4c8c3ba55ba793afa065bf261a7bccac8816c348 Reviewed-on: https://boringssl-review.googlesource.com/8989 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-27 22:51:49 +01:00
msg_hdr.seq == ssl->d1->handshake_read_seq - 1) {
Remove dtls1_read_bytes. It can be folded into dtls1_read_app_data. This code, since it still takes an output pointer, does not yet process records atomically. (Though, being DTLS, it probably should...) Change-Id: I57d60785c9c1dd13b5b2ed158a08a8f5a518db4f Reviewed-on: https://boringssl-review.googlesource.com/8177 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 01:49:50 +01:00
if (msg_hdr.frag_off == 0) {
/* Retransmit our last flight of messages. If the peer sends the second
* Finished, they may not have received ours. Only do this for the
* first fragment, in case the Finished was fragmented. */
if (dtls1_check_timeout_num(ssl) < 0) {
return -1;
}
Stop using the word 'buffer' everywhere. buffer buffer buffer buffer buffer. At some point, words lose their meaning if they're used too many times. Notably, the DTLS code can't decide whether a "buffered message" is an incoming message to be reassembled or an outgoing message to be (re)transmitted. Change-Id: Ibdde5c00abb062c603d21be97aff49e1c422c755 Reviewed-on: https://boringssl-review.googlesource.com/8500 Reviewed-by: Adam Langley <agl@google.com>
2016-06-23 22:49:12 +01:00
dtls1_retransmit_outgoing_messages(ssl);
Remove dtls1_read_bytes. It can be folded into dtls1_read_app_data. This code, since it still takes an output pointer, does not yet process records atomically. (Though, being DTLS, it probably should...) Change-Id: I57d60785c9c1dd13b5b2ed158a08a8f5a518db4f Reviewed-on: https://boringssl-review.googlesource.com/8177 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 01:49:50 +01:00
}
rr->length = 0;
goto again;
}
/* Otherwise, this is a pre-CCS handshake message from an unsupported
* renegotiation attempt. Fall through to the error path. */
}
if (rr->type != SSL3_RT_APPLICATION_DATA) {
ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE);
OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_RECORD);
return -1;
}
/* Discard empty records. */
if (rr->length == 0) {
goto again;
}
if (len <= 0) {
return len;
}
if ((unsigned)len > rr->length) {
len = rr->length;
}
memcpy(buf, rr->data, len);
if (!peek) {
/* TODO(davidben): Should the record be truncated instead? This is a
* datagram transport. See https://crbug.com/boringssl/65. */
rr->length -= len;
rr->data += len;
if (rr->length == 0) {
/* The record has been consumed, so we may now clear the buffer. */
ssl_read_buffer_discard(ssl);
}
}
return len;
Split ssl_read_bytes hook into app_data and close_notify hooks. This still needs significant work, especially the close_notify half, but clarify the interface and get *_read_bytes out of SSL_PROTOCOL_METHOD. read_bytes is an implementation detail of those two and get_message rather than both an implementation detail of get_message for handshake and a (wholly inappropriate) exposed interface for the other two. BUG=468889 Change-Id: I7dd23869e0b7c3532ceb2e9dd31ca25ea31128e7 Reviewed-on: https://boringssl-review.googlesource.com/4956 Reviewed-by: Adam Langley <agl@google.com>
2015-05-30 21:22:10 +01:00
}
Pull ChangeCipherSpec into the handshake state machine. This uses ssl3_read_bytes for now. We still need to dismantle that function and then invert the handshake state machine, but this gets things closer to the right shape as an intermediate step and is a large chunk in itself. It simplifies a lot of the CCS/handshake synchronization as a lot of the invariants much more clearly follow from the handshake itself. Tests need to be adjusted since this changes some error codes. Now all the CCS/Handshake checks fall through to the usual SSL_R_UNEXPECTED_RECORD codepath. Most of what used to be a special-case falls out naturally. (If half of Finished was in the same record as the pre-CCS message, that part of the handshake record would have been left unconsumed, so read_change_cipher_spec would have noticed, just like read_app_data would have noticed.) Change-Id: I15c7501afe523d5062f0e24a3b65f053008d87be Reviewed-on: https://boringssl-review.googlesource.com/6642 Reviewed-by: Adam Langley <agl@google.com>
2015-11-26 07:16:49 +00:00
int dtls1_read_change_cipher_spec(SSL *ssl) {
Don't call read_bytes in read_change_cipher_spec. Change-Id: If7d50e43c8ea28c5eed38209f31d481fb57bf225 Reviewed-on: https://boringssl-review.googlesource.com/8175 Reviewed-by: David Benjamin <davidben@google.com>
2016-05-11 01:46:16 +01:00
SSL3_RECORD *rr = &ssl->s3->rrec;
again:
if (rr->length == 0) {
int ret = dtls1_get_record(ssl);
if (ret <= 0) {
return ret;
}
Pull ChangeCipherSpec into the handshake state machine. This uses ssl3_read_bytes for now. We still need to dismantle that function and then invert the handshake state machine, but this gets things closer to the right shape as an intermediate step and is a large chunk in itself. It simplifies a lot of the CCS/handshake synchronization as a lot of the invariants much more clearly follow from the handshake itself. Tests need to be adjusted since this changes some error codes. Now all the CCS/Handshake checks fall through to the usual SSL_R_UNEXPECTED_RECORD codepath. Most of what used to be a special-case falls out naturally. (If half of Finished was in the same record as the pre-CCS message, that part of the handshake record would have been left unconsumed, so read_change_cipher_spec would have noticed, just like read_app_data would have noticed.) Change-Id: I15c7501afe523d5062f0e24a3b65f053008d87be Reviewed-on: https://boringssl-review.googlesource.com/6642 Reviewed-by: Adam Langley <agl@google.com>
2015-11-26 07:16:49 +00:00
}
Don't call read_bytes in read_change_cipher_spec. Change-Id: If7d50e43c8ea28c5eed38209f31d481fb57bf225 Reviewed-on: https://boringssl-review.googlesource.com/8175 Reviewed-by: David Benjamin <davidben@google.com>
2016-05-11 01:46:16 +01:00
/* Drop handshake records silently. The epochs match, so this must be a
* retransmit of a message we already received. */
if (rr->type == SSL3_RT_HANDSHAKE) {
rr->length = 0;
goto again;
}
/* Other record types are illegal in this epoch. Note all application data
* records come in the encrypted epoch. */
if (rr->type != SSL3_RT_CHANGE_CIPHER_SPEC) {
ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE);
OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_RECORD);
return -1;
}
if (rr->length != 1 || rr->data[0] != SSL3_MT_CCS) {
Pull ChangeCipherSpec into the handshake state machine. This uses ssl3_read_bytes for now. We still need to dismantle that function and then invert the handshake state machine, but this gets things closer to the right shape as an intermediate step and is a large chunk in itself. It simplifies a lot of the CCS/handshake synchronization as a lot of the invariants much more clearly follow from the handshake itself. Tests need to be adjusted since this changes some error codes. Now all the CCS/Handshake checks fall through to the usual SSL_R_UNEXPECTED_RECORD codepath. Most of what used to be a special-case falls out naturally. (If half of Finished was in the same record as the pre-CCS message, that part of the handshake record would have been left unconsumed, so read_change_cipher_spec would have noticed, just like read_app_data would have noticed.) Change-Id: I15c7501afe523d5062f0e24a3b65f053008d87be Reviewed-on: https://boringssl-review.googlesource.com/6642 Reviewed-by: Adam Langley <agl@google.com>
2015-11-26 07:16:49 +00:00
OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_CHANGE_CIPHER_SPEC);
ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
return -1;
}
Add helper functions for info_callback and msg_callback. This is getting a little repetitive. Change-Id: Ib0fa8ab10149557c2d728b88648381b9368221d9 Reviewed-on: https://boringssl-review.googlesource.com/8126 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 01:16:03 +01:00
ssl_do_msg_callback(ssl, 0 /* read */, ssl->version,
Don't call read_bytes in read_change_cipher_spec. Change-Id: If7d50e43c8ea28c5eed38209f31d481fb57bf225 Reviewed-on: https://boringssl-review.googlesource.com/8175 Reviewed-by: David Benjamin <davidben@google.com>
2016-05-11 01:46:16 +01:00
SSL3_RT_CHANGE_CIPHER_SPEC, rr->data, rr->length);
rr->length = 0;
ssl_read_buffer_discard(ssl);
Pull ChangeCipherSpec into the handshake state machine. This uses ssl3_read_bytes for now. We still need to dismantle that function and then invert the handshake state machine, but this gets things closer to the right shape as an intermediate step and is a large chunk in itself. It simplifies a lot of the CCS/handshake synchronization as a lot of the invariants much more clearly follow from the handshake itself. Tests need to be adjusted since this changes some error codes. Now all the CCS/Handshake checks fall through to the usual SSL_R_UNEXPECTED_RECORD codepath. Most of what used to be a special-case falls out naturally. (If half of Finished was in the same record as the pre-CCS message, that part of the handshake record would have been left unconsumed, so read_change_cipher_spec would have noticed, just like read_app_data would have noticed.) Change-Id: I15c7501afe523d5062f0e24a3b65f053008d87be Reviewed-on: https://boringssl-review.googlesource.com/6642 Reviewed-by: Adam Langley <agl@google.com>
2015-11-26 07:16:49 +00:00
return 1;
}
Split ssl_read_bytes hook into app_data and close_notify hooks. This still needs significant work, especially the close_notify half, but clarify the interface and get *_read_bytes out of SSL_PROTOCOL_METHOD. read_bytes is an implementation detail of those two and get_message rather than both an implementation detail of get_message for handshake and a (wholly inappropriate) exposed interface for the other two. BUG=468889 Change-Id: I7dd23869e0b7c3532ceb2e9dd31ca25ea31128e7 Reviewed-on: https://boringssl-review.googlesource.com/4956 Reviewed-by: Adam Langley <agl@google.com>
2015-05-30 21:22:10 +01:00
void dtls1_read_close_notify(SSL *ssl) {
Don't support bidirectional shutdown over DTLS. Bidirectional shutdown doesn't make sense over DTLS; you can't reuse the underlying channel after receiving close_notify because the channel is unordered. This removes one caller of dtls1_read_bytes. Really close_notify makes no sense in DTLS. It can't even protect against some kind of truncation because it's all unordered. But continue to send it in case anything is (unreliably since the channel is lossy) relying on close_notify to signal some kind of session end. This only makes SSL_shutdown stop trying to wait for one once we've already decided to shut down the connection. BUG=526437 Change-Id: I6afad7cb7209c4aba0b96f9246b04c81d90987a9 Reviewed-on: https://boringssl-review.googlesource.com/5770 Reviewed-by: Adam Langley <agl@google.com>
2015-08-22 16:31:33 +01:00
/* Bidirectional shutdown doesn't make sense for an unordered transport. DTLS
* alerts also aren't delivered reliably, so we may even time out because the
* peer never received our close_notify. Report to the caller that the channel
* has fully shut down. */
Tidy up shutdown state. The existing logic gets confused in a number of cases around close_notify vs. fatal alert. SSL_shutdown, while still pushing to the error queue, will fail to notice alerts. We also get confused if we try to send a fatal alert when we've already sent something else. Change-Id: I9b1d217fbf1ee8a9c59efbebba60165b7de9689e Reviewed-on: https://boringssl-review.googlesource.com/7952 Reviewed-by: David Benjamin <davidben@google.com>
2016-05-10 22:03:10 +01:00
if (ssl->s3->recv_shutdown == ssl_shutdown_none) {
ssl->s3->recv_shutdown = ssl_shutdown_close_notify;
}
Split ssl_read_bytes hook into app_data and close_notify hooks. This still needs significant work, especially the close_notify half, but clarify the interface and get *_read_bytes out of SSL_PROTOCOL_METHOD. read_bytes is an implementation detail of those two and get_message rather than both an implementation detail of get_message for handshake and a (wholly inappropriate) exposed interface for the other two. BUG=468889 Change-Id: I7dd23869e0b7c3532ceb2e9dd31ca25ea31128e7 Reviewed-on: https://boringssl-review.googlesource.com/4956 Reviewed-by: Adam Langley <agl@google.com>
2015-05-30 21:22:10 +01:00
}
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
int dtls1_write_app_data(SSL *ssl, const void *buf_, int len) {
Lift the handshake driving in write_bytes up to SSL_write. This removes one use of in_handshake and consolidates some DTLS and TLS code. Change-Id: Ibbdd38360a983dabfb7b18c7bd59cb5e316b2adb Reviewed-on: https://boringssl-review.googlesource.com/7435 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-10 05:41:25 +00:00
assert(!SSL_in_init(ssl));
Reformatting of several DTLS source files. This change has no semantic effect (I hope!). It's just a reformatting of a few files in ssl/. This is just a start – the other files in ssl/ should follow in the coming days. Change-Id: I5eb3f4b18d0d46349d0f94d3fe5ab2003db5364e
2014-12-14 00:28:18 +00:00
if (len > SSL3_RT_MAX_PLAIN_LENGTH) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(SSL, SSL_R_DTLS_MESSAGE_TOO_BIG);
Reformatting of several DTLS source files. This change has no semantic effect (I hope!). It's just a reformatting of a few files in ssl/. This is just a start – the other files in ssl/ should follow in the coming days. Change-Id: I5eb3f4b18d0d46349d0f94d3fe5ab2003db5364e
2014-12-14 00:28:18 +00:00
return -1;
}
Trim the DTLS write code slightly. Change-Id: I0fb4152ed656a60fae3aa7922652df766d4978d7 Reviewed-on: https://boringssl-review.googlesource.com/8178 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-07 20:20:49 +01:00
if (len < 0) {
OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_LENGTH);
return -1;
}
Reformatting of several DTLS source files. This change has no semantic effect (I hope!). It's just a reformatting of a few files in ssl/. This is just a start – the other files in ssl/ should follow in the coming days. Change-Id: I5eb3f4b18d0d46349d0f94d3fe5ab2003db5364e
2014-12-14 00:28:18 +00:00
Trim the DTLS write code slightly. Change-Id: I0fb4152ed656a60fae3aa7922652df766d4978d7 Reviewed-on: https://boringssl-review.googlesource.com/8178 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-07 20:20:49 +01:00
if (len == 0) {
return 0;
}
int ret = dtls1_write_record(ssl, SSL3_RT_APPLICATION_DATA, buf_, (size_t)len,
dtls1_use_current_epoch);
if (ret <= 0) {
return ret;
}
return len;
Reformatting of several DTLS source files. This change has no semantic effect (I hope!). It's just a reformatting of a few files in ssl/. This is just a start – the other files in ssl/ should follow in the coming days. Change-Id: I5eb3f4b18d0d46349d0f94d3fe5ab2003db5364e
2014-12-14 00:28:18 +00:00
}
Trim the DTLS write code slightly. Change-Id: I0fb4152ed656a60fae3aa7922652df766d4978d7 Reviewed-on: https://boringssl-review.googlesource.com/8178 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-07 20:20:49 +01:00
int dtls1_write_record(SSL *ssl, int type, const uint8_t *buf, size_t len,
enum dtls1_use_epoch_t use_epoch) {
assert(len <= SSL3_RT_MAX_PLAIN_LENGTH);
Don't use ssl3_write_pending in DTLS. That function doesn't do anything useful for DTLS. It's meant for tracking the rest of the record we've already committed to by writing half of one. But one cannot write half a datagram, so DTLS never tracks this. Just call ssl_write_buffer_flush straight and don't touch wpend_*. Change-Id: Ibe191907d64c955c7cfeefba26f5c11ad5e4b939 Reviewed-on: https://boringssl-review.googlesource.com/6418 Reviewed-by: Adam Langley <agl@google.com>
2015-11-02 22:50:10 +00:00
/* There should never be a pending write buffer in DTLS. One can't write half
* a datagram, so the write buffer is always dropped in
* |ssl_write_buffer_flush|. */
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
assert(!ssl_write_buffer_is_pending(ssl));
Reformatting of several DTLS source files. This change has no semantic effect (I hope!). It's just a reformatting of a few files in ssl/. This is just a start – the other files in ssl/ should follow in the coming days. Change-Id: I5eb3f4b18d0d46349d0f94d3fe5ab2003db5364e
2014-12-14 00:28:18 +00:00
Factor SSL_AEAD_CTX into a dedicated type. tls1_enc is now SSL_AEAD_CTX_{open,seal}. This starts tidying up a bit of the record-layer logic. This removes rr->input, as encrypting and decrypting records no longer refers to various globals. It also removes wrec altogether. SSL3_RECORD is now only used to maintain state about the current incoming record. Outgoing records go straight to the write buffer. This also removes the outgoing alignment memcpy and simply calls SSL_AEAD_CTX_seal with the parameters as appropriate. From bssl speed tests, this seems to be faster on non-ARM and a bit of a wash on ARM. Later it may be worth recasting these open/seal functions to write into a CBB (tweaked so it can be malloc-averse), but for now they take an out/out_len/max_out trio like their EVP_AEAD counterparts. BUG=468889 Change-Id: Ie9266a818cc053f695d35ef611fd74c5d4def6c3 Reviewed-on: https://boringssl-review.googlesource.com/4792 Reviewed-by: Adam Langley <agl@google.com>
2015-03-03 19:20:26 +00:00
/* If we have an alert to send, lets send it */
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
if (ssl->s3->alert_dispatch) {
Remove the 'ssl_' prefix on most SSL_PROTOCOL_METHOD hooks. It doesn't really convey anything useful. Leave ssl_get_message alone for now since it's called everywhere in the handshake and I'm about to tweak it further. Change-Id: I6f3a74c170e818f624be8fbe5cf6b796353406df Reviewed-on: https://boringssl-review.googlesource.com/8430 Reviewed-by: Adam Langley <agl@google.com>
2016-06-15 22:44:37 +01:00
int ret = ssl->method->dispatch_alert(ssl);
Factor SSL_AEAD_CTX into a dedicated type. tls1_enc is now SSL_AEAD_CTX_{open,seal}. This starts tidying up a bit of the record-layer logic. This removes rr->input, as encrypting and decrypting records no longer refers to various globals. It also removes wrec altogether. SSL3_RECORD is now only used to maintain state about the current incoming record. Outgoing records go straight to the write buffer. This also removes the outgoing alignment memcpy and simply calls SSL_AEAD_CTX_seal with the parameters as appropriate. From bssl speed tests, this seems to be faster on non-ARM and a bit of a wash on ARM. Later it may be worth recasting these open/seal functions to write into a CBB (tweaked so it can be malloc-averse), but for now they take an out/out_len/max_out trio like their EVP_AEAD counterparts. BUG=468889 Change-Id: Ie9266a818cc053f695d35ef611fd74c5d4def6c3 Reviewed-on: https://boringssl-review.googlesource.com/4792 Reviewed-by: Adam Langley <agl@google.com>
2015-03-03 19:20:26 +00:00
if (ret <= 0) {
return ret;
}
/* if it went, fall through and send more stuff */
Reformatting of several DTLS source files. This change has no semantic effect (I hope!). It's just a reformatting of a few files in ssl/. This is just a start – the other files in ssl/ should follow in the coming days. Change-Id: I5eb3f4b18d0d46349d0f94d3fe5ab2003db5364e
2014-12-14 00:28:18 +00:00
}
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
if (len > SSL3_RT_MAX_PLAIN_LENGTH) {
OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
Factor SSL_AEAD_CTX into a dedicated type. tls1_enc is now SSL_AEAD_CTX_{open,seal}. This starts tidying up a bit of the record-layer logic. This removes rr->input, as encrypting and decrypting records no longer refers to various globals. It also removes wrec altogether. SSL3_RECORD is now only used to maintain state about the current incoming record. Outgoing records go straight to the write buffer. This also removes the outgoing alignment memcpy and simply calls SSL_AEAD_CTX_seal with the parameters as appropriate. From bssl speed tests, this seems to be faster on non-ARM and a bit of a wash on ARM. Later it may be worth recasting these open/seal functions to write into a CBB (tweaked so it can be malloc-averse), but for now they take an out/out_len/max_out trio like their EVP_AEAD counterparts. BUG=468889 Change-Id: Ie9266a818cc053f695d35ef611fd74c5d4def6c3 Reviewed-on: https://boringssl-review.googlesource.com/4792 Reviewed-by: Adam Langley <agl@google.com>
2015-03-03 19:20:26 +00:00
return -1;
}
Reformatting of several DTLS source files. This change has no semantic effect (I hope!). It's just a reformatting of a few files in ssl/. This is just a start – the other files in ssl/ should follow in the coming days. Change-Id: I5eb3f4b18d0d46349d0f94d3fe5ab2003db5364e
2014-12-14 00:28:18 +00:00
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
size_t max_out = len + ssl_max_seal_overhead(ssl);
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
uint8_t *out;
Factor SSL_AEAD_CTX into a dedicated type. tls1_enc is now SSL_AEAD_CTX_{open,seal}. This starts tidying up a bit of the record-layer logic. This removes rr->input, as encrypting and decrypting records no longer refers to various globals. It also removes wrec altogether. SSL3_RECORD is now only used to maintain state about the current incoming record. Outgoing records go straight to the write buffer. This also removes the outgoing alignment memcpy and simply calls SSL_AEAD_CTX_seal with the parameters as appropriate. From bssl speed tests, this seems to be faster on non-ARM and a bit of a wash on ARM. Later it may be worth recasting these open/seal functions to write into a CBB (tweaked so it can be malloc-averse), but for now they take an out/out_len/max_out trio like their EVP_AEAD counterparts. BUG=468889 Change-Id: Ie9266a818cc053f695d35ef611fd74c5d4def6c3 Reviewed-on: https://boringssl-review.googlesource.com/4792 Reviewed-by: Adam Langley <agl@google.com>
2015-03-03 19:20:26 +00:00
size_t ciphertext_len;
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
if (!ssl_write_buffer_init(ssl, &out, max_out) ||
!dtls_seal_record(ssl, out, &ciphertext_len, max_out, type, buf, len,
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
use_epoch)) {
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
ssl_write_buffer_clear(ssl);
Factor SSL_AEAD_CTX into a dedicated type. tls1_enc is now SSL_AEAD_CTX_{open,seal}. This starts tidying up a bit of the record-layer logic. This removes rr->input, as encrypting and decrypting records no longer refers to various globals. It also removes wrec altogether. SSL3_RECORD is now only used to maintain state about the current incoming record. Outgoing records go straight to the write buffer. This also removes the outgoing alignment memcpy and simply calls SSL_AEAD_CTX_seal with the parameters as appropriate. From bssl speed tests, this seems to be faster on non-ARM and a bit of a wash on ARM. Later it may be worth recasting these open/seal functions to write into a CBB (tweaked so it can be malloc-averse), but for now they take an out/out_len/max_out trio like their EVP_AEAD counterparts. BUG=468889 Change-Id: Ie9266a818cc053f695d35ef611fd74c5d4def6c3 Reviewed-on: https://boringssl-review.googlesource.com/4792 Reviewed-by: Adam Langley <agl@google.com>
2015-03-03 19:20:26 +00:00
return -1;
Factor out sequence number updates. Also check for overflow, although it really shouldn't happen. Change-Id: I34dfe8eaf635aeaa8bef2656fda3cd0bad7e1268 Reviewed-on: https://boringssl-review.googlesource.com/4235 Reviewed-by: Adam Langley <agl@google.com>
2015-04-05 05:21:39 +01:00
}
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
ssl_write_buffer_set_len(ssl, ciphertext_len);
Reformatting of several DTLS source files. This change has no semantic effect (I hope!). It's just a reformatting of a few files in ssl/. This is just a start – the other files in ssl/ should follow in the coming days. Change-Id: I5eb3f4b18d0d46349d0f94d3fe5ab2003db5364e
2014-12-14 00:28:18 +00:00
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
int ret = ssl_write_buffer_flush(ssl);
Don't use ssl3_write_pending in DTLS. That function doesn't do anything useful for DTLS. It's meant for tracking the rest of the record we've already committed to by writing half of one. But one cannot write half a datagram, so DTLS never tracks this. Just call ssl_write_buffer_flush straight and don't touch wpend_*. Change-Id: Ibe191907d64c955c7cfeefba26f5c11ad5e4b939 Reviewed-on: https://boringssl-review.googlesource.com/6418 Reviewed-by: Adam Langley <agl@google.com>
2015-11-02 22:50:10 +00:00
if (ret <= 0) {
return ret;
}
Trim the DTLS write code slightly. Change-Id: I0fb4152ed656a60fae3aa7922652df766d4978d7 Reviewed-on: https://boringssl-review.googlesource.com/8178 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-07 20:20:49 +01:00
return 1;
Reformatting of several DTLS source files. This change has no semantic effect (I hope!). It's just a reformatting of a few files in ssl/. This is just a start – the other files in ssl/ should follow in the coming days. Change-Id: I5eb3f4b18d0d46349d0f94d3fe5ab2003db5364e
2014-12-14 00:28:18 +00:00
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
int dtls1_dispatch_alert(SSL *ssl) {
ssl->s3->alert_dispatch = 0;
Trim the DTLS write code slightly. Change-Id: I0fb4152ed656a60fae3aa7922652df766d4978d7 Reviewed-on: https://boringssl-review.googlesource.com/8178 Reviewed-by: David Benjamin <davidben@google.com>
2016-06-07 20:20:49 +01:00
int ret = dtls1_write_record(ssl, SSL3_RT_ALERT, &ssl->s3->send_alert[0], 2,
dtls1_use_current_epoch);
Clean up some silly variable names. Change-Id: I5b38e2938811520f52ece6055245248c80308b4d Reviewed-on: https://boringssl-review.googlesource.com/7416 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-03-10 06:41:55 +00:00
if (ret <= 0) {
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
ssl->s3->alert_dispatch = 1;
Clean up some silly variable names. Change-Id: I5b38e2938811520f52ece6055245248c80308b4d Reviewed-on: https://boringssl-review.googlesource.com/7416 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-03-10 06:41:55 +00:00
return ret;
}
Reformatting of several DTLS source files. This change has no semantic effect (I hope!). It's just a reformatting of a few files in ssl/. This is just a start – the other files in ssl/ should follow in the coming days. Change-Id: I5eb3f4b18d0d46349d0f94d3fe5ab2003db5364e
2014-12-14 00:28:18 +00:00
Clean up some silly variable names. Change-Id: I5b38e2938811520f52ece6055245248c80308b4d Reviewed-on: https://boringssl-review.googlesource.com/7416 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-03-10 06:41:55 +00:00
/* If the alert is fatal, flush the BIO now. */
if (ssl->s3->send_alert[0] == SSL3_AL_FATAL) {
BIO_flush(ssl->wbio);
}
Reformatting of several DTLS source files. This change has no semantic effect (I hope!). It's just a reformatting of a few files in ssl/. This is just a start – the other files in ssl/ should follow in the coming days. Change-Id: I5eb3f4b18d0d46349d0f94d3fe5ab2003db5364e
2014-12-14 00:28:18 +00:00
Add helper functions for info_callback and msg_callback. This is getting a little repetitive. Change-Id: Ib0fa8ab10149557c2d728b88648381b9368221d9 Reviewed-on: https://boringssl-review.googlesource.com/8126 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 01:16:03 +01:00
ssl_do_msg_callback(ssl, 1 /* write */, ssl->version, SSL3_RT_ALERT,
ssl->s3->send_alert, 2);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Add helper functions for info_callback and msg_callback. This is getting a little repetitive. Change-Id: Ib0fa8ab10149557c2d728b88648381b9368221d9 Reviewed-on: https://boringssl-review.googlesource.com/8126 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 01:16:03 +01:00
int alert = (ssl->s3->send_alert[0] << 8) | ssl->s3->send_alert[1];
ssl_do_info_callback(ssl, SSL_CB_WRITE_ALERT, alert);
Clean up some silly variable names. Change-Id: I5b38e2938811520f52ece6055245248c80308b4d Reviewed-on: https://boringssl-review.googlesource.com/7416 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-03-10 06:41:55 +00:00
return 1;
Reformatting of several DTLS source files. This change has no semantic effect (I hope!). It's just a reformatting of a few files in ssl/. This is just a start – the other files in ssl/ should follow in the coming days. Change-Id: I5eb3f4b18d0d46349d0f94d3fe5ab2003db5364e
2014-12-14 00:28:18 +00:00
}
Reference in New Issue Copy Permalink