kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
d4aae0f965
boringssl/ssl/s3_pkt.c

501 lines
16 KiB
C
Raw Normal View History

Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
/* ====================================================================
* Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. All advertising materials mentioning features or use of this
* software must display the following acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
* endorse or promote products derived from this software without
* prior written permission. For written permission, please contact
* openssl-core@openssl.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
* nor may "OpenSSL" appear in their names without prior written
* permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
* acknowledgment:
* "This product includes software developed by the OpenSSL Project
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*
* This product includes cryptographic software written by Eric Young
* (eay@cryptsoft.com). This product includes software written by Tim
* Hudson (tjh@cryptsoft.com). */
Align the SSL stack on #include style. ssl.h should be first. Also two lines after includes and the rest of the file. Change-Id: Icb7586e00a3e64170082c96cf3f8bfbb2b7e1611 Reviewed-on: https://boringssl-review.googlesource.com/5892 Reviewed-by: Adam Langley <agl@google.com>
2015-09-15 06:48:04 +01:00
#include <openssl/ssl.h>
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
#include <assert.h>
Added OPENSSL_assert check as per PR#3377 reported by Rainer Jung <rainer.jung@kippdata.de> (Imported from upstream's 955bfbc2686153b50aebb045a42d96e5b026e29c)
2014-06-20 20:00:00 +01:00
#include <limits.h>
Include-what-you-use ssl/internal.h. The rest of ssl/ still includes things everywhere, but this at least fixes the includes that were implicit from ssl/internal.h. Change-Id: I7ed22590aca0fe78af84fd99a3e557f4b05f6782 Reviewed-on: https://boringssl-review.googlesource.com/4281 Reviewed-by: Adam Langley <agl@google.com>
2015-04-08 04:05:04 +01:00
#include <string.h>
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
#include <openssl/buf.h>
#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/mem.h>
#include <openssl/rand.h>
Rename ssl_locl.h to internal.h Match the other internal headers. Change-Id: Iff7e2dd06a1a7bf993053d0464cc15638ace3aaa Reviewed-on: https://boringssl-review.googlesource.com/4280 Reviewed-by: Adam Langley <agl@google.com>
2015-04-08 03:38:30 +01:00
#include "internal.h"
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
static int do_ssl3_write(SSL *ssl, int type, const uint8_t *buf, unsigned len);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
/* ssl3_get_record reads a new input record. On success, it places it in
* |ssl->s3->rrec| and returns one. Otherwise it returns <= 0 on error or if
* more data is needed. */
static int ssl3_get_record(SSL *ssl) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
again:
Tidy up shutdown state. The existing logic gets confused in a number of cases around close_notify vs. fatal alert. SSL_shutdown, while still pushing to the error queue, will fail to notice alerts. We also get confused if we try to send a fatal alert when we've already sent something else. Change-Id: I9b1d217fbf1ee8a9c59efbebba60165b7de9689e Reviewed-on: https://boringssl-review.googlesource.com/7952 Reviewed-by: David Benjamin <davidben@google.com>
2016-05-10 22:03:10 +01:00
switch (ssl->s3->recv_shutdown) {
case ssl_shutdown_none:
break;
case ssl_shutdown_fatal_alert:
OPENSSL_PUT_ERROR(SSL, SSL_R_PROTOCOL_IS_SHUTDOWN);
return -1;
case ssl_shutdown_close_notify:
Consolidate SSL_RECEIVED_SHUTDOWN checks. SSL_RECEIVED_SHUTDOWN checks in the record layer happen in two different places. Some operations (but not all) check it, and so does read_bytes. Move it to get_record. This check should be at a low-level since it is otherwise duplicated in every operation. It is also a signal which originates from around the peer's record layer, so it makes sense to check it near the same code. (This one's in get_record which is technically lower-level than read_bytes, but we're trying to get rid of read_bytes. They're very coupled functions.) Also, if we've seen a fatal alert, replay an error, not an EOF. Change-Id: Idec35c5068ddabe5b1a9145016d8f945da2421cf Reviewed-on: https://boringssl-review.googlesource.com/7436 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-10 06:15:15 +00:00
return 0;
}
Make tls_open_record always in-place. The business with ssl_record_prefix_len is rather a hassle. Instead, have tls_open_record always decrypt in-place and give back a CBS to where the body is. This way the caller doesn't need to do an extra check all to avoid creating an invalid pointer and underflow in subtraction. Change-Id: I4e12b25a760870d8f8a503673ab00a2d774fc9ee Reviewed-on: https://boringssl-review.googlesource.com/8173 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-06 23:54:51 +01:00
CBS body;
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
uint8_t type, alert;
Make tls_open_record always in-place. The business with ssl_record_prefix_len is rather a hassle. Instead, have tls_open_record always decrypt in-place and give back a CBS to where the body is. This way the caller doesn't need to do an extra check all to avoid creating an invalid pointer and underflow in subtraction. Change-Id: I4e12b25a760870d8f8a503673ab00a2d774fc9ee Reviewed-on: https://boringssl-review.googlesource.com/8173 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-06 23:54:51 +01:00
size_t consumed;
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
enum ssl_open_record_t open_ret =
Make tls_open_record always in-place. The business with ssl_record_prefix_len is rather a hassle. Instead, have tls_open_record always decrypt in-place and give back a CBS to where the body is. This way the caller doesn't need to do an extra check all to avoid creating an invalid pointer and underflow in subtraction. Change-Id: I4e12b25a760870d8f8a503673ab00a2d774fc9ee Reviewed-on: https://boringssl-review.googlesource.com/8173 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-06 23:54:51 +01:00
tls_open_record(ssl, &type, &body, &consumed, &alert,
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
ssl_read_buffer(ssl), ssl_read_buffer_len(ssl));
if (open_ret != ssl_open_record_partial) {
ssl_read_buffer_consume(ssl, consumed);
}
switch (open_ret) {
Make tls_open_record always in-place. The business with ssl_record_prefix_len is rather a hassle. Instead, have tls_open_record always decrypt in-place and give back a CBS to where the body is. This way the caller doesn't need to do an extra check all to avoid creating an invalid pointer and underflow in subtraction. Change-Id: I4e12b25a760870d8f8a503673ab00a2d774fc9ee Reviewed-on: https://boringssl-review.googlesource.com/8173 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-06 23:54:51 +01:00
case ssl_open_record_partial: {
int read_ret = ssl_read_buffer_extend_to(ssl, consumed);
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
if (read_ret <= 0) {
return read_ret;
}
goto again;
Make tls_open_record always in-place. The business with ssl_record_prefix_len is rather a hassle. Instead, have tls_open_record always decrypt in-place and give back a CBS to where the body is. This way the caller doesn't need to do an extra check all to avoid creating an invalid pointer and underflow in subtraction. Change-Id: I4e12b25a760870d8f8a503673ab00a2d774fc9ee Reviewed-on: https://boringssl-review.googlesource.com/8173 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-06 23:54:51 +01:00
}
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
case ssl_open_record_success:
Make tls_open_record always in-place. The business with ssl_record_prefix_len is rather a hassle. Instead, have tls_open_record always decrypt in-place and give back a CBS to where the body is. This way the caller doesn't need to do an extra check all to avoid creating an invalid pointer and underflow in subtraction. Change-Id: I4e12b25a760870d8f8a503673ab00a2d774fc9ee Reviewed-on: https://boringssl-review.googlesource.com/8173 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-06 23:54:51 +01:00
if (CBS_len(&body) > 0xffff) {
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW);
return -1;
}
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
SSL3_RECORD *rr = &ssl->s3->rrec;
rr->type = type;
Make tls_open_record always in-place. The business with ssl_record_prefix_len is rather a hassle. Instead, have tls_open_record always decrypt in-place and give back a CBS to where the body is. This way the caller doesn't need to do an extra check all to avoid creating an invalid pointer and underflow in subtraction. Change-Id: I4e12b25a760870d8f8a503673ab00a2d774fc9ee Reviewed-on: https://boringssl-review.googlesource.com/8173 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-06 23:54:51 +01:00
rr->length = (uint16_t)CBS_len(&body);
rr->data = (uint8_t *)CBS_data(&body);
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
return 1;
case ssl_open_record_discard:
goto again;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
Push alert handling down into the record functions. Alert handling is more-or-less identical across all contexts. Push it down from read_bytes into the low-level record functions. This also deduplicates the code shared between TLS and DTLS. Now the only type mismatch managed by read_bytes is if we get handshake data in read_app_data. Change-Id: Ia8331897b304566e66d901899cfbf31d2870194e Reviewed-on: https://boringssl-review.googlesource.com/8124 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 20:42:01 +01:00
case ssl_open_record_close_notify:
return 0;
case ssl_open_record_fatal_alert:
return -1;
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
case ssl_open_record_error:
ssl3_send_alert(ssl, SSL3_AL_FATAL, alert);
return -1;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
assert(0);
OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
return -1;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
}
Switch the ssl_write_bytes hook to ssl_write_app_data. The SSL_PROTOCOL_METHOD table needs work, but this makes it clearer exactly what the shared interface between the upper later and TLS/DTLS is. BUG=468889 Change-Id: I38931c484aa4ab3f77964d708d38bfd349fac293 Reviewed-on: https://boringssl-review.googlesource.com/4955 Reviewed-by: Adam Langley <agl@google.com>
2015-05-30 21:14:58 +01:00
int ssl3_write_app_data(SSL *ssl, const void *buf, int len) {
Lift the handshake driving in write_bytes up to SSL_write. This removes one use of in_handshake and consolidates some DTLS and TLS code. Change-Id: Ibbdd38360a983dabfb7b18c7bd59cb5e316b2adb Reviewed-on: https://boringssl-review.googlesource.com/7435 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-10 05:41:25 +00:00
assert(!SSL_in_init(ssl) || SSL_in_false_start(ssl));
Switch the ssl_write_bytes hook to ssl_write_app_data. The SSL_PROTOCOL_METHOD table needs work, but this makes it clearer exactly what the shared interface between the upper later and TLS/DTLS is. BUG=468889 Change-Id: I38931c484aa4ab3f77964d708d38bfd349fac293 Reviewed-on: https://boringssl-review.googlesource.com/4955 Reviewed-by: Adam Langley <agl@google.com>
2015-05-30 21:14:58 +01:00
return ssl3_write_bytes(ssl, SSL3_RT_APPLICATION_DATA, buf, len);
}
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
/* Call this to write data in records of type |type|. It will return <= 0 if
* not all data has been sent or non-blocking IO. */
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
int ssl3_write_bytes(SSL *ssl, int type, const void *buf_, int len) {
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
const uint8_t *buf = buf_;
Clean up some silly variable names. Change-Id: I5b38e2938811520f52ece6055245248c80308b4d Reviewed-on: https://boringssl-review.googlesource.com/7416 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-03-10 06:41:55 +00:00
unsigned tot, n, nw;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
assert(ssl->s3->wnum <= INT_MAX);
tot = ssl->s3->wnum;
ssl->s3->wnum = 0;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
/* Ensure that if we end up with a smaller value of data to write out than
* the the original len from a write which didn't complete for non-blocking
* I/O and also somehow ended up avoiding the check for this in
* ssl3_write_pending/SSL_R_BAD_WRITE_RETRY as it must never be possible to
* end up with (len-tot) as a large number that will then promptly send
* beyond the end of the users buffer ... so we trap and report the error in
* a way the user will notice. */
if (len < 0 || (size_t)len < tot) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_LENGTH);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return -1;
}
n = (len - tot);
for (;;) {
/* max contains the maximum number of bytes that we can put into a
* record. */
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
unsigned max = ssl->max_send_fragment;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
if (n > max) {
nw = max;
} else {
nw = n;
}
Clean up some silly variable names. Change-Id: I5b38e2938811520f52ece6055245248c80308b4d Reviewed-on: https://boringssl-review.googlesource.com/7416 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-03-10 06:41:55 +00:00
int ret = do_ssl3_write(ssl, type, &buf[tot], nw);
if (ret <= 0) {
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
ssl->s3->wnum = tot;
Clean up some silly variable names. Change-Id: I5b38e2938811520f52ece6055245248c80308b4d Reviewed-on: https://boringssl-review.googlesource.com/7416 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-03-10 06:41:55 +00:00
return ret;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
}
Clean up some silly variable names. Change-Id: I5b38e2938811520f52ece6055245248c80308b4d Reviewed-on: https://boringssl-review.googlesource.com/7416 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-03-10 06:41:55 +00:00
if (ret == (int)n || (type == SSL3_RT_APPLICATION_DATA &&
(ssl->mode & SSL_MODE_ENABLE_PARTIAL_WRITE))) {
return tot + ret;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
}
Clean up some silly variable names. Change-Id: I5b38e2938811520f52ece6055245248c80308b4d Reviewed-on: https://boringssl-review.googlesource.com/7416 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-03-10 06:41:55 +00:00
n -= ret;
tot += ret;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
}
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
static int ssl3_write_pending(SSL *ssl, int type, const uint8_t *buf,
Don't use ssl3_write_pending in DTLS. That function doesn't do anything useful for DTLS. It's meant for tracking the rest of the record we've already committed to by writing half of one. But one cannot write half a datagram, so DTLS never tracks this. Just call ssl_write_buffer_flush straight and don't touch wpend_*. Change-Id: Ibe191907d64c955c7cfeefba26f5c11ad5e4b939 Reviewed-on: https://boringssl-review.googlesource.com/6418 Reviewed-by: Adam Langley <agl@google.com>
2015-11-02 22:50:10 +00:00
unsigned int len) {
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
if (ssl->s3->wpend_tot > (int)len ||
(ssl->s3->wpend_buf != buf &&
!(ssl->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER)) ||
ssl->s3->wpend_type != type) {
Don't use ssl3_write_pending in DTLS. That function doesn't do anything useful for DTLS. It's meant for tracking the rest of the record we've already committed to by writing half of one. But one cannot write half a datagram, so DTLS never tracks this. Just call ssl_write_buffer_flush straight and don't touch wpend_*. Change-Id: Ibe191907d64c955c7cfeefba26f5c11ad5e4b939 Reviewed-on: https://boringssl-review.googlesource.com/6418 Reviewed-by: Adam Langley <agl@google.com>
2015-11-02 22:50:10 +00:00
OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_WRITE_RETRY);
return -1;
}
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
int ret = ssl_write_buffer_flush(ssl);
Don't use ssl3_write_pending in DTLS. That function doesn't do anything useful for DTLS. It's meant for tracking the rest of the record we've already committed to by writing half of one. But one cannot write half a datagram, so DTLS never tracks this. Just call ssl_write_buffer_flush straight and don't touch wpend_*. Change-Id: Ibe191907d64c955c7cfeefba26f5c11ad5e4b939 Reviewed-on: https://boringssl-review.googlesource.com/6418 Reviewed-by: Adam Langley <agl@google.com>
2015-11-02 22:50:10 +00:00
if (ret <= 0) {
return ret;
}
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
return ssl->s3->wpend_ret;
Don't use ssl3_write_pending in DTLS. That function doesn't do anything useful for DTLS. It's meant for tracking the rest of the record we've already committed to by writing half of one. But one cannot write half a datagram, so DTLS never tracks this. Just call ssl_write_buffer_flush straight and don't touch wpend_*. Change-Id: Ibe191907d64c955c7cfeefba26f5c11ad5e4b939 Reviewed-on: https://boringssl-review.googlesource.com/6418 Reviewed-by: Adam Langley <agl@google.com>
2015-11-02 22:50:10 +00:00
}
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
/* do_ssl3_write writes an SSL record of the given type. */
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
static int do_ssl3_write(SSL *ssl, int type, const uint8_t *buf, unsigned len) {
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
/* If there is still data from the previous record, flush it. */
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
if (ssl_write_buffer_is_pending(ssl)) {
return ssl3_write_pending(ssl, type, buf, len);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
}
/* If we have an alert to send, lets send it */
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
if (ssl->s3->alert_dispatch) {
Remove the 'ssl_' prefix on most SSL_PROTOCOL_METHOD hooks. It doesn't really convey anything useful. Leave ssl_get_message alone for now since it's called everywhere in the handshake and I'm about to tweak it further. Change-Id: I6f3a74c170e818f624be8fbe5cf6b796353406df Reviewed-on: https://boringssl-review.googlesource.com/8430 Reviewed-by: Adam Langley <agl@google.com>
2016-06-15 22:44:37 +01:00
int ret = ssl->method->dispatch_alert(ssl);
Clean up do_ssl3_write fragment handling. Separate actually writing the fragment to the network from assembling it so there is no need for is_fragment. record_split_done also needn't be a global; as of 7fdeaf11017b82368e0a97547fc491b90ad40f67, it is always reset to 0 whether or not SSL3_WANT_WRITE occurred, despite the comment. I believe this is sound, but the pre-7fdeaf1 logic wasn't quiiite right; ssl3_write_pending allows a retry to supply *additional* data, so not all plaintext had been commited to before the IV was randomized. We could fix this by tracking how many bytes were committed to the last time we fragmented, but this is purely an optimization and doesn't seem worth the complexity. This also fixes the alignment computation in the record-splitting case. The extra byte was wrong, as demonstrated by the assert. Change-Id: Ia087a45a6622f4faad32e501942cc910eca1237b Reviewed-on: https://boringssl-review.googlesource.com/4234 Reviewed-by: Adam Langley <agl@google.com>
2015-04-05 00:23:10 +01:00
if (ret <= 0) {
return ret;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
}
/* if it went, fall through and send more stuff */
}
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
if (len > SSL3_RT_MAX_PLAIN_LENGTH) {
OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return -1;
}
if (len == 0) {
return 0;
}
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
size_t max_out = len + ssl_max_seal_overhead(ssl);
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
if (max_out < len) {
OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW);
return -1;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
}
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
uint8_t *out;
Clean up do_ssl3_write fragment handling. Separate actually writing the fragment to the network from assembling it so there is no need for is_fragment. record_split_done also needn't be a global; as of 7fdeaf11017b82368e0a97547fc491b90ad40f67, it is always reset to 0 whether or not SSL3_WANT_WRITE occurred, despite the comment. I believe this is sound, but the pre-7fdeaf1 logic wasn't quiiite right; ssl3_write_pending allows a retry to supply *additional* data, so not all plaintext had been commited to before the IV was randomized. We could fix this by tracking how many bytes were committed to the last time we fragmented, but this is purely an optimization and doesn't seem worth the complexity. This also fixes the alignment computation in the record-splitting case. The extra byte was wrong, as demonstrated by the assert. Change-Id: Ia087a45a6622f4faad32e501942cc910eca1237b Reviewed-on: https://boringssl-review.googlesource.com/4234 Reviewed-by: Adam Langley <agl@google.com>
2015-04-05 00:23:10 +01:00
size_t ciphertext_len;
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
if (!ssl_write_buffer_init(ssl, &out, max_out) ||
!tls_seal_record(ssl, out, &ciphertext_len, max_out, type, buf, len)) {
Clean up do_ssl3_write fragment handling. Separate actually writing the fragment to the network from assembling it so there is no need for is_fragment. record_split_done also needn't be a global; as of 7fdeaf11017b82368e0a97547fc491b90ad40f67, it is always reset to 0 whether or not SSL3_WANT_WRITE occurred, despite the comment. I believe this is sound, but the pre-7fdeaf1 logic wasn't quiiite right; ssl3_write_pending allows a retry to supply *additional* data, so not all plaintext had been commited to before the IV was randomized. We could fix this by tracking how many bytes were committed to the last time we fragmented, but this is purely an optimization and doesn't seem worth the complexity. This also fixes the alignment computation in the record-splitting case. The extra byte was wrong, as demonstrated by the assert. Change-Id: Ia087a45a6622f4faad32e501942cc910eca1237b Reviewed-on: https://boringssl-review.googlesource.com/4234 Reviewed-by: Adam Langley <agl@google.com>
2015-04-05 00:23:10 +01:00
return -1;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
}
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
ssl_write_buffer_set_len(ssl, ciphertext_len);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
/* memorize arguments so that ssl3_write_pending can detect bad write retries
* later */
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
ssl->s3->wpend_tot = len;
ssl->s3->wpend_buf = buf;
ssl->s3->wpend_type = type;
ssl->s3->wpend_ret = len;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
/* we now just need to write the buffer */
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
return ssl3_write_pending(ssl, type, buf, len);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Move post-handshake message handling out of read_app_data. This finishes getting rid of ssl_read_bytes! Now we have separate entry-points for the various cases. For now, I've kept TLS handshake consuming records partially. When we do the BIO-less API, I expect that will need to change, since we won't have the record buffer available. (Instead, the ssl3_read_handshake_bytes and extend_handshake_buffer pair will look more like the DTLS side or Go and pull the entire record into init_buf.) This change opts to make read_app_data drive the message to completion in anticipation of DTLS 1.3. That hasn't been specified, but NewSessionTicket certainly will exist. Knowing that DTLS necessarily has interleave seems something better suited for the SSL_PROTOCOL_METHOD internals to drive. It needs refining, but SSL_PROTOCOL_METHOD is now actually a half-decent abstraction boundary between the higher-level protocol logic and DTLS/TLS-specific record-layer and message dispatchy bits. BUG=83 Change-Id: I9b4626bb8a29d9cb30174d9e6912bb420ed45aff Reviewed-on: https://boringssl-review.googlesource.com/9001 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-28 16:05:58 +01:00
static int consume_record(SSL *ssl, uint8_t *out, int len, int peek) {
SSL3_RECORD *rr = &ssl->s3->rrec;
if (len <= 0) {
return len;
}
if (len > (int)rr->length) {
len = (int)rr->length;
}
memcpy(out, rr->data, len);
if (!peek) {
rr->length -= len;
rr->data += len;
if (rr->length == 0) {
/* The record has been consumed, so we may now clear the buffer. */
ssl_read_buffer_discard(ssl);
}
}
return len;
}
int ssl3_read_app_data(SSL *ssl, int *out_got_handshake, uint8_t *buf, int len,
int peek) {
Move implicit handshake driving out of read_bytes. This removes the final use of in_handshake. Note that there is still a rentrant call of read_bytes -> handshake_func when we see a HelloRequest. That will need to be signaled up to ssl_read_impl separately out of read_app_data. Change-Id: I823de243f75e6b73eb40c6cf44157b4fc21eb8fb Reviewed-on: https://boringssl-review.googlesource.com/7439 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-10 06:28:00 +00:00
assert(!SSL_in_init(ssl));
Lift an impossible check to an assert. This cannot happen. Change-Id: Ib1b473aa91d6479eeff43f7eaf94906d0b2c2a8f Reviewed-on: https://boringssl-review.googlesource.com/8123 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-05-12 14:34:55 +01:00
assert(ssl->s3->initial_handshake_complete);
Move post-handshake message handling out of read_app_data. This finishes getting rid of ssl_read_bytes! Now we have separate entry-points for the various cases. For now, I've kept TLS handshake consuming records partially. When we do the BIO-less API, I expect that will need to change, since we won't have the record buffer available. (Instead, the ssl3_read_handshake_bytes and extend_handshake_buffer pair will look more like the DTLS side or Go and pull the entire record into init_buf.) This change opts to make read_app_data drive the message to completion in anticipation of DTLS 1.3. That hasn't been specified, but NewSessionTicket certainly will exist. Knowing that DTLS necessarily has interleave seems something better suited for the SSL_PROTOCOL_METHOD internals to drive. It needs refining, but SSL_PROTOCOL_METHOD is now actually a half-decent abstraction boundary between the higher-level protocol logic and DTLS/TLS-specific record-layer and message dispatchy bits. BUG=83 Change-Id: I9b4626bb8a29d9cb30174d9e6912bb420ed45aff Reviewed-on: https://boringssl-review.googlesource.com/9001 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-28 16:05:58 +01:00
*out_got_handshake = 0;
SSL3_RECORD *rr = &ssl->s3->rrec;
for (;;) {
/* A previous iteration may have read a partial handshake message. Do not
* allow more app data in that case. */
int has_hs_data = ssl->init_buf != NULL && ssl->init_buf->length > 0;
/* Get new packet if necessary. */
if (rr->length == 0 && !has_hs_data) {
int ret = ssl3_get_record(ssl);
if (ret <= 0) {
return ret;
}
}
if (has_hs_data || rr->type == SSL3_RT_HANDSHAKE) {
/* Post-handshake data prior to TLS 1.3 is always renegotiation, which we
* never accept as a server. Otherwise |ssl3_get_message| will send
* |SSL_R_EXCESSIVE_MESSAGE_SIZE|. */
if (ssl->server && ssl3_protocol_version(ssl) < TLS1_3_VERSION) {
ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_NO_RENEGOTIATION);
OPENSSL_PUT_ERROR(SSL, SSL_R_NO_RENEGOTIATION);
return -1;
}
/* Parse post-handshake handshake messages. */
int ret = ssl3_get_message(ssl, -1, ssl_dont_hash_message);
if (ret <= 0) {
return ret;
}
*out_got_handshake = 1;
return -1;
}
if (rr->type != SSL3_RT_APPLICATION_DATA) {
OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_RECORD);
ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE);
return -1;
}
Lift an impossible check to an assert. This cannot happen. Change-Id: Ib1b473aa91d6479eeff43f7eaf94906d0b2c2a8f Reviewed-on: https://boringssl-review.googlesource.com/8123 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-05-12 14:34:55 +01:00
Move post-handshake message handling out of read_app_data. This finishes getting rid of ssl_read_bytes! Now we have separate entry-points for the various cases. For now, I've kept TLS handshake consuming records partially. When we do the BIO-less API, I expect that will need to change, since we won't have the record buffer available. (Instead, the ssl3_read_handshake_bytes and extend_handshake_buffer pair will look more like the DTLS side or Go and pull the entire record into init_buf.) This change opts to make read_app_data drive the message to completion in anticipation of DTLS 1.3. That hasn't been specified, but NewSessionTicket certainly will exist. Knowing that DTLS necessarily has interleave seems something better suited for the SSL_PROTOCOL_METHOD internals to drive. It needs refining, but SSL_PROTOCOL_METHOD is now actually a half-decent abstraction boundary between the higher-level protocol logic and DTLS/TLS-specific record-layer and message dispatchy bits. BUG=83 Change-Id: I9b4626bb8a29d9cb30174d9e6912bb420ed45aff Reviewed-on: https://boringssl-review.googlesource.com/9001 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-28 16:05:58 +01:00
if (rr->length != 0) {
return consume_record(ssl, buf, len, peek);
}
/* Discard empty records and loop again. */
}
Pull ChangeCipherSpec into the handshake state machine. This uses ssl3_read_bytes for now. We still need to dismantle that function and then invert the handshake state machine, but this gets things closer to the right shape as an intermediate step and is a large chunk in itself. It simplifies a lot of the CCS/handshake synchronization as a lot of the invariants much more clearly follow from the handshake itself. Tests need to be adjusted since this changes some error codes. Now all the CCS/Handshake checks fall through to the usual SSL_R_UNEXPECTED_RECORD codepath. Most of what used to be a special-case falls out naturally. (If half of Finished was in the same record as the pre-CCS message, that part of the handshake record would have been left unconsumed, so read_change_cipher_spec would have noticed, just like read_app_data would have noticed.) Change-Id: I15c7501afe523d5062f0e24a3b65f053008d87be Reviewed-on: https://boringssl-review.googlesource.com/6642 Reviewed-by: Adam Langley <agl@google.com>
2015-11-26 07:16:49 +00:00
}
int ssl3_read_change_cipher_spec(SSL *ssl) {
Don't call read_bytes in read_change_cipher_spec. Change-Id: If7d50e43c8ea28c5eed38209f31d481fb57bf225 Reviewed-on: https://boringssl-review.googlesource.com/8175 Reviewed-by: David Benjamin <davidben@google.com>
2016-05-11 01:46:16 +01:00
SSL3_RECORD *rr = &ssl->s3->rrec;
if (rr->length == 0) {
int ret = ssl3_get_record(ssl);
if (ret <= 0) {
return ret;
}
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
}
Don't call read_bytes in read_change_cipher_spec. Change-Id: If7d50e43c8ea28c5eed38209f31d481fb57bf225 Reviewed-on: https://boringssl-review.googlesource.com/8175 Reviewed-by: David Benjamin <davidben@google.com>
2016-05-11 01:46:16 +01:00
if (rr->type != SSL3_RT_CHANGE_CIPHER_SPEC) {
ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE);
OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_RECORD);
return -1;
}
if (rr->length != 1 || rr->data[0] != SSL3_MT_CCS) {
Pull ChangeCipherSpec into the handshake state machine. This uses ssl3_read_bytes for now. We still need to dismantle that function and then invert the handshake state machine, but this gets things closer to the right shape as an intermediate step and is a large chunk in itself. It simplifies a lot of the CCS/handshake synchronization as a lot of the invariants much more clearly follow from the handshake itself. Tests need to be adjusted since this changes some error codes. Now all the CCS/Handshake checks fall through to the usual SSL_R_UNEXPECTED_RECORD codepath. Most of what used to be a special-case falls out naturally. (If half of Finished was in the same record as the pre-CCS message, that part of the handshake record would have been left unconsumed, so read_change_cipher_spec would have noticed, just like read_app_data would have noticed.) Change-Id: I15c7501afe523d5062f0e24a3b65f053008d87be Reviewed-on: https://boringssl-review.googlesource.com/6642 Reviewed-by: Adam Langley <agl@google.com>
2015-11-26 07:16:49 +00:00
OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_CHANGE_CIPHER_SPEC);
ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
return -1;
}
Change CCS_OK to EXPECT_CCS. Now that the flag is set accurately, use it to enforce that the handshake and CCS synchronization. If EXPECT_CCS is set, enforce that: (a) No handshake records may be received before ChangeCipherSpec. (b) There is no pending handshake data at the point EXPECT_CCS is set. Change-Id: I04b228fe6a7a771cf6600b7d38aa762b2d553f08 Reviewed-on: https://boringssl-review.googlesource.com/1299 Reviewed-by: Adam Langley <agl@google.com>
2014-07-21 21:14:03 +01:00
Add helper functions for info_callback and msg_callback. This is getting a little repetitive. Change-Id: Ib0fa8ab10149557c2d728b88648381b9368221d9 Reviewed-on: https://boringssl-review.googlesource.com/8126 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 01:16:03 +01:00
ssl_do_msg_callback(ssl, 0 /* read */, ssl->version,
Don't call read_bytes in read_change_cipher_spec. Change-Id: If7d50e43c8ea28c5eed38209f31d481fb57bf225 Reviewed-on: https://boringssl-review.googlesource.com/8175 Reviewed-by: David Benjamin <davidben@google.com>
2016-05-11 01:46:16 +01:00
SSL3_RT_CHANGE_CIPHER_SPEC, rr->data, rr->length);
rr->length = 0;
ssl_read_buffer_discard(ssl);
Pull ChangeCipherSpec into the handshake state machine. This uses ssl3_read_bytes for now. We still need to dismantle that function and then invert the handshake state machine, but this gets things closer to the right shape as an intermediate step and is a large chunk in itself. It simplifies a lot of the CCS/handshake synchronization as a lot of the invariants much more clearly follow from the handshake itself. Tests need to be adjusted since this changes some error codes. Now all the CCS/Handshake checks fall through to the usual SSL_R_UNEXPECTED_RECORD codepath. Most of what used to be a special-case falls out naturally. (If half of Finished was in the same record as the pre-CCS message, that part of the handshake record would have been left unconsumed, so read_change_cipher_spec would have noticed, just like read_app_data would have noticed.) Change-Id: I15c7501afe523d5062f0e24a3b65f053008d87be Reviewed-on: https://boringssl-review.googlesource.com/6642 Reviewed-by: Adam Langley <agl@google.com>
2015-11-26 07:16:49 +00:00
return 1;
Split ssl_read_bytes hook into app_data and close_notify hooks. This still needs significant work, especially the close_notify half, but clarify the interface and get *_read_bytes out of SSL_PROTOCOL_METHOD. read_bytes is an implementation detail of those two and get_message rather than both an implementation detail of get_message for handshake and a (wholly inappropriate) exposed interface for the other two. BUG=468889 Change-Id: I7dd23869e0b7c3532ceb2e9dd31ca25ea31128e7 Reviewed-on: https://boringssl-review.googlesource.com/4956 Reviewed-by: Adam Langley <agl@google.com>
2015-05-30 21:22:10 +01:00
}
void ssl3_read_close_notify(SSL *ssl) {
Don't use ssl3_read_bytes in ssl3_read_close_notify. read_close_notify is a very straight-forward hook and doesn't need much. Change-Id: I7407d842321ea1bcb47838424a0d8f7550ad71ca Reviewed-on: https://boringssl-review.googlesource.com/8174 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 00:40:23 +01:00
/* Read records until an error or close_notify. */
while (ssl3_get_record(ssl) > 0) {
;
}
Split ssl_read_bytes hook into app_data and close_notify hooks. This still needs significant work, especially the close_notify half, but clarify the interface and get *_read_bytes out of SSL_PROTOCOL_METHOD. read_bytes is an implementation detail of those two and get_message rather than both an implementation detail of get_message for handshake and a (wholly inappropriate) exposed interface for the other two. BUG=468889 Change-Id: I7dd23869e0b7c3532ceb2e9dd31ca25ea31128e7 Reviewed-on: https://boringssl-review.googlesource.com/4956 Reviewed-by: Adam Langley <agl@google.com>
2015-05-30 21:22:10 +01:00
}
Move post-handshake message handling out of read_app_data. This finishes getting rid of ssl_read_bytes! Now we have separate entry-points for the various cases. For now, I've kept TLS handshake consuming records partially. When we do the BIO-less API, I expect that will need to change, since we won't have the record buffer available. (Instead, the ssl3_read_handshake_bytes and extend_handshake_buffer pair will look more like the DTLS side or Go and pull the entire record into init_buf.) This change opts to make read_app_data drive the message to completion in anticipation of DTLS 1.3. That hasn't been specified, but NewSessionTicket certainly will exist. Knowing that DTLS necessarily has interleave seems something better suited for the SSL_PROTOCOL_METHOD internals to drive. It needs refining, but SSL_PROTOCOL_METHOD is now actually a half-decent abstraction boundary between the higher-level protocol logic and DTLS/TLS-specific record-layer and message dispatchy bits. BUG=83 Change-Id: I9b4626bb8a29d9cb30174d9e6912bb420ed45aff Reviewed-on: https://boringssl-review.googlesource.com/9001 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-28 16:05:58 +01:00
int ssl3_read_handshake_bytes(SSL *ssl, uint8_t *buf, int len) {
SSL3_RECORD *rr = &ssl->s3->rrec;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
Move post-handshake message handling out of read_app_data. This finishes getting rid of ssl_read_bytes! Now we have separate entry-points for the various cases. For now, I've kept TLS handshake consuming records partially. When we do the BIO-less API, I expect that will need to change, since we won't have the record buffer available. (Instead, the ssl3_read_handshake_bytes and extend_handshake_buffer pair will look more like the DTLS side or Go and pull the entire record into init_buf.) This change opts to make read_app_data drive the message to completion in anticipation of DTLS 1.3. That hasn't been specified, but NewSessionTicket certainly will exist. Knowing that DTLS necessarily has interleave seems something better suited for the SSL_PROTOCOL_METHOD internals to drive. It needs refining, but SSL_PROTOCOL_METHOD is now actually a half-decent abstraction boundary between the higher-level protocol logic and DTLS/TLS-specific record-layer and message dispatchy bits. BUG=83 Change-Id: I9b4626bb8a29d9cb30174d9e6912bb420ed45aff Reviewed-on: https://boringssl-review.googlesource.com/9001 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-28 16:05:58 +01:00
for (;;) {
/* Get new packet if necessary. */
Reject empty records of unexpected type. The old empty record logic discarded the records at a very low-level. Let the error bubble up to ssl3_read_bytes so the type mismatch logic may kick in before the empty record is skipped. Add tests for when the record in question is application data, before before the handshake and post ChangeCipherSpec. BUG=521840 Change-Id: I47dff389cda65d6672b9be39d7d89490331063fa Reviewed-on: https://boringssl-review.googlesource.com/5754 Reviewed-by: Adam Langley <agl@google.com>
2015-08-22 06:35:43 +01:00
if (rr->length == 0) {
Move post-handshake message handling out of read_app_data. This finishes getting rid of ssl_read_bytes! Now we have separate entry-points for the various cases. For now, I've kept TLS handshake consuming records partially. When we do the BIO-less API, I expect that will need to change, since we won't have the record buffer available. (Instead, the ssl3_read_handshake_bytes and extend_handshake_buffer pair will look more like the DTLS side or Go and pull the entire record into init_buf.) This change opts to make read_app_data drive the message to completion in anticipation of DTLS 1.3. That hasn't been specified, but NewSessionTicket certainly will exist. Knowing that DTLS necessarily has interleave seems something better suited for the SSL_PROTOCOL_METHOD internals to drive. It needs refining, but SSL_PROTOCOL_METHOD is now actually a half-decent abstraction boundary between the higher-level protocol logic and DTLS/TLS-specific record-layer and message dispatchy bits. BUG=83 Change-Id: I9b4626bb8a29d9cb30174d9e6912bb420ed45aff Reviewed-on: https://boringssl-review.googlesource.com/9001 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-28 16:05:58 +01:00
int ret = ssl3_get_record(ssl);
if (ret <= 0) {
return ret;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
}
}
Move post-handshake message handling out of read_app_data. This finishes getting rid of ssl_read_bytes! Now we have separate entry-points for the various cases. For now, I've kept TLS handshake consuming records partially. When we do the BIO-less API, I expect that will need to change, since we won't have the record buffer available. (Instead, the ssl3_read_handshake_bytes and extend_handshake_buffer pair will look more like the DTLS side or Go and pull the entire record into init_buf.) This change opts to make read_app_data drive the message to completion in anticipation of DTLS 1.3. That hasn't been specified, but NewSessionTicket certainly will exist. Knowing that DTLS necessarily has interleave seems something better suited for the SSL_PROTOCOL_METHOD internals to drive. It needs refining, but SSL_PROTOCOL_METHOD is now actually a half-decent abstraction boundary between the higher-level protocol logic and DTLS/TLS-specific record-layer and message dispatchy bits. BUG=83 Change-Id: I9b4626bb8a29d9cb30174d9e6912bb420ed45aff Reviewed-on: https://boringssl-review.googlesource.com/9001 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-28 16:05:58 +01:00
if (rr->type != SSL3_RT_HANDSHAKE) {
OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_RECORD);
ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE);
return -1;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
}
Remove renegotiation deferral logic. When the peer or caller requests a renegotiation, OpenSSL doesn't renegotiate immediately. It sets a flag to begin a renegotiation as soon as record-layer read and write buffers are clear. One reason is that OpenSSL's record layer cannot write a handshake record while an application data record is being written. The buffer consistency checks around partial writes will break. None of these cases are relevant for the client auth hack. We already require that renego come in at a quiescent part of the application protocol by forbidding handshake/app_data interleave. The new behavior is now: when a HelloRequest comes in, if the record layer is not idle, the renegotiation is rejected as if SSL_set_reject_peer_renegotiations were set. Otherwise we immediately begin the new handshake. The server may not send any application data between HelloRequest and completing the handshake. The HelloRequest may not be consumed if an SSL_write is pending. Note this does require that Chromium's HTTP stack not attempt to read the HTTP response until the request has been written, but the renegotiation logic already assumes it. Were Chromium to drive the SSL_read state machine early and the server, say, sent a HelloRequest after reading the request headers but before we've sent the whole POST body, the SSL state machine may racily enter renegotiate early, block writing the POST body on the new handshake, which would break Chromium's ERR_SSL_CLIENT_AUTH_CERT_NEEDED plumbing. BUG=429450 Change-Id: I6278240c3bceb5d2e1a2195bdb62dd9e0f4df718 Reviewed-on: https://boringssl-review.googlesource.com/4825 Reviewed-by: Adam Langley <agl@google.com>
2015-05-21 06:37:55 +01:00
Move post-handshake message handling out of read_app_data. This finishes getting rid of ssl_read_bytes! Now we have separate entry-points for the various cases. For now, I've kept TLS handshake consuming records partially. When we do the BIO-less API, I expect that will need to change, since we won't have the record buffer available. (Instead, the ssl3_read_handshake_bytes and extend_handshake_buffer pair will look more like the DTLS side or Go and pull the entire record into init_buf.) This change opts to make read_app_data drive the message to completion in anticipation of DTLS 1.3. That hasn't been specified, but NewSessionTicket certainly will exist. Knowing that DTLS necessarily has interleave seems something better suited for the SSL_PROTOCOL_METHOD internals to drive. It needs refining, but SSL_PROTOCOL_METHOD is now actually a half-decent abstraction boundary between the higher-level protocol logic and DTLS/TLS-specific record-layer and message dispatchy bits. BUG=83 Change-Id: I9b4626bb8a29d9cb30174d9e6912bb420ed45aff Reviewed-on: https://boringssl-review.googlesource.com/9001 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-28 16:05:58 +01:00
if (rr->length != 0) {
return consume_record(ssl, buf, len, 0 /* consume data */);
Remove renegotiation deferral logic. When the peer or caller requests a renegotiation, OpenSSL doesn't renegotiate immediately. It sets a flag to begin a renegotiation as soon as record-layer read and write buffers are clear. One reason is that OpenSSL's record layer cannot write a handshake record while an application data record is being written. The buffer consistency checks around partial writes will break. None of these cases are relevant for the client auth hack. We already require that renego come in at a quiescent part of the application protocol by forbidding handshake/app_data interleave. The new behavior is now: when a HelloRequest comes in, if the record layer is not idle, the renegotiation is rejected as if SSL_set_reject_peer_renegotiations were set. Otherwise we immediately begin the new handshake. The server may not send any application data between HelloRequest and completing the handshake. The HelloRequest may not be consumed if an SSL_write is pending. Note this does require that Chromium's HTTP stack not attempt to read the HTTP response until the request has been written, but the renegotiation logic already assumes it. Were Chromium to drive the SSL_read state machine early and the server, say, sent a HelloRequest after reading the request headers but before we've sent the whole POST body, the SSL state machine may racily enter renegotiate early, block writing the POST body on the new handshake, which would break Chromium's ERR_SSL_CLIENT_AUTH_CERT_NEEDED plumbing. BUG=429450 Change-Id: I6278240c3bceb5d2e1a2195bdb62dd9e0f4df718 Reviewed-on: https://boringssl-review.googlesource.com/4825 Reviewed-by: Adam Langley <agl@google.com>
2015-05-21 06:37:55 +01:00
}
Move post-handshake message handling out of read_app_data. This finishes getting rid of ssl_read_bytes! Now we have separate entry-points for the various cases. For now, I've kept TLS handshake consuming records partially. When we do the BIO-less API, I expect that will need to change, since we won't have the record buffer available. (Instead, the ssl3_read_handshake_bytes and extend_handshake_buffer pair will look more like the DTLS side or Go and pull the entire record into init_buf.) This change opts to make read_app_data drive the message to completion in anticipation of DTLS 1.3. That hasn't been specified, but NewSessionTicket certainly will exist. Knowing that DTLS necessarily has interleave seems something better suited for the SSL_PROTOCOL_METHOD internals to drive. It needs refining, but SSL_PROTOCOL_METHOD is now actually a half-decent abstraction boundary between the higher-level protocol logic and DTLS/TLS-specific record-layer and message dispatchy bits. BUG=83 Change-Id: I9b4626bb8a29d9cb30174d9e6912bb420ed45aff Reviewed-on: https://boringssl-review.googlesource.com/9001 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-28 16:05:58 +01:00
/* Discard empty records and loop again. */
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
}
}
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
int ssl3_send_alert(SSL *ssl, int level, int desc) {
Tidy up shutdown state. The existing logic gets confused in a number of cases around close_notify vs. fatal alert. SSL_shutdown, while still pushing to the error queue, will fail to notice alerts. We also get confused if we try to send a fatal alert when we've already sent something else. Change-Id: I9b1d217fbf1ee8a9c59efbebba60165b7de9689e Reviewed-on: https://boringssl-review.googlesource.com/7952 Reviewed-by: David Benjamin <davidben@google.com>
2016-05-10 22:03:10 +01:00
/* It is illegal to send an alert when we've already sent a closing one. */
if (ssl->s3->send_shutdown != ssl_shutdown_none) {
OPENSSL_PUT_ERROR(SSL, SSL_R_PROTOCOL_IS_SHUTDOWN);
return -1;
}
if (level == SSL3_AL_FATAL) {
if (ssl->session != NULL) {
SSL_CTX_remove_session(ssl->ctx, ssl->session);
}
ssl->s3->send_shutdown = ssl_shutdown_fatal_alert;
} else if (level == SSL3_AL_WARNING && desc == SSL_AD_CLOSE_NOTIFY) {
ssl->s3->send_shutdown = ssl_shutdown_close_notify;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
}
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
ssl->s3->alert_dispatch = 1;
ssl->s3->send_alert[0] = level;
ssl->s3->send_alert[1] = desc;
if (!ssl_write_buffer_is_pending(ssl)) {
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
/* Nothing is being written out, so the alert may be dispatched
* immediately. */
Remove the 'ssl_' prefix on most SSL_PROTOCOL_METHOD hooks. It doesn't really convey anything useful. Leave ssl_get_message alone for now since it's called everywhere in the handshake and I'm about to tweak it further. Change-Id: I6f3a74c170e818f624be8fbe5cf6b796353406df Reviewed-on: https://boringssl-review.googlesource.com/8430 Reviewed-by: Adam Langley <agl@google.com>
2016-06-15 22:44:37 +01:00
return ssl->method->dispatch_alert(ssl);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
}
Tidy up shutdown state. The existing logic gets confused in a number of cases around close_notify vs. fatal alert. SSL_shutdown, while still pushing to the error queue, will fail to notice alerts. We also get confused if we try to send a fatal alert when we've already sent something else. Change-Id: I9b1d217fbf1ee8a9c59efbebba60165b7de9689e Reviewed-on: https://boringssl-review.googlesource.com/7952 Reviewed-by: David Benjamin <davidben@google.com>
2016-05-10 22:03:10 +01:00
/* The alert will be dispatched later. */
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
return -1;
}
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
int ssl3_dispatch_alert(SSL *ssl) {
ssl->s3->alert_dispatch = 0;
Clean up some silly variable names. Change-Id: I5b38e2938811520f52ece6055245248c80308b4d Reviewed-on: https://boringssl-review.googlesource.com/7416 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-03-10 06:41:55 +00:00
int ret = do_ssl3_write(ssl, SSL3_RT_ALERT, &ssl->s3->send_alert[0], 2);
if (ret <= 0) {
Switch s to ssl everywhere. That we're half and half is really confusing. Change-Id: I1c2632682e8a3e63d01dada8e0eb3b735ff709ce Reviewed-on: https://boringssl-review.googlesource.com/6785 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 22:05:56 +00:00
ssl->s3->alert_dispatch = 1;
Clean up some silly variable names. Change-Id: I5b38e2938811520f52ece6055245248c80308b4d Reviewed-on: https://boringssl-review.googlesource.com/7416 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-03-10 06:41:55 +00:00
return ret;
}
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
Clean up some silly variable names. Change-Id: I5b38e2938811520f52ece6055245248c80308b4d Reviewed-on: https://boringssl-review.googlesource.com/7416 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-03-10 06:41:55 +00:00
/* If the alert is fatal, flush the BIO now. */
if (ssl->s3->send_alert[0] == SSL3_AL_FATAL) {
BIO_flush(ssl->wbio);
}
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
Add helper functions for info_callback and msg_callback. This is getting a little repetitive. Change-Id: Ib0fa8ab10149557c2d728b88648381b9368221d9 Reviewed-on: https://boringssl-review.googlesource.com/8126 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 01:16:03 +01:00
ssl_do_msg_callback(ssl, 1 /* write */, ssl->version, SSL3_RT_ALERT,
ssl->s3->send_alert, 2);
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
Add helper functions for info_callback and msg_callback. This is getting a little repetitive. Change-Id: Ib0fa8ab10149557c2d728b88648381b9368221d9 Reviewed-on: https://boringssl-review.googlesource.com/8126 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-02 01:16:03 +01:00
int alert = (ssl->s3->send_alert[0] << 8) | ssl->s3->send_alert[1];
ssl_do_info_callback(ssl, SSL_CB_WRITE_ALERT, alert);
Clean up some silly variable names. Change-Id: I5b38e2938811520f52ece6055245248c80308b4d Reviewed-on: https://boringssl-review.googlesource.com/7416 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-03-10 06:41:55 +00:00
return 1;
Reformat the rest of ssl/. Change-Id: I7dc264f7e29b3ba8be4c717583467edf71bf8dd9
2014-12-19 01:42:32 +00:00
}
Reference in New Issue Copy Permalink