]>
Commit | Line | Data |
---|---|---|
846e33c7 | 1 | /* |
0789c7d8 | 2 | * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. |
c103c7e2 | 3 | * |
2c18d164 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
846e33c7 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
c103c7e2 MC |
8 | */ |
9 | ||
706457b7 | 10 | #include "ssl_local.h" |
c103c7e2 | 11 | |
38b051a1 | 12 | int ssl3_do_change_cipher_spec(SSL_CONNECTION *s) |
c103c7e2 MC |
13 | { |
14 | int i; | |
38b051a1 | 15 | SSL *ssl = SSL_CONNECTION_GET_SSL(s); |
c103c7e2 | 16 | |
49ae7423 | 17 | if (s->server) |
c103c7e2 MC |
18 | i = SSL3_CHANGE_CIPHER_SERVER_READ; |
19 | else | |
20 | i = SSL3_CHANGE_CIPHER_CLIENT_READ; | |
21 | ||
555cbb32 | 22 | if (s->s3.tmp.key_block == NULL) { |
c103c7e2 MC |
23 | if (s->session == NULL || s->session->master_key_length == 0) { |
24 | /* might happen if dtls1_read_bytes() calls this */ | |
6849b73c | 25 | ERR_raise(ERR_LIB_SSL, SSL_R_CCS_RECEIVED_EARLY); |
26a7d938 | 26 | return 0; |
c103c7e2 MC |
27 | } |
28 | ||
555cbb32 | 29 | s->session->cipher = s->s3.tmp.new_cipher; |
38b051a1 | 30 | if (!ssl->method->ssl3_enc->setup_key_block(s)) { |
157af9be | 31 | /* SSLfatal() already called */ |
26a7d938 | 32 | return 0; |
157af9be | 33 | } |
c103c7e2 MC |
34 | } |
35 | ||
38b051a1 | 36 | if (!ssl->method->ssl3_enc->change_cipher_state(s, i)) { |
157af9be | 37 | /* SSLfatal() already called */ |
26a7d938 | 38 | return 0; |
157af9be | 39 | } |
c103c7e2 | 40 | |
208fb891 | 41 | return 1; |
c103c7e2 MC |
42 | } |
43 | ||
38b051a1 | 44 | int ssl3_send_alert(SSL_CONNECTION *s, int level, int desc) |
c103c7e2 | 45 | { |
38b051a1 TM |
46 | SSL *ssl = SSL_CONNECTION_GET_SSL(s); |
47 | ||
c103c7e2 | 48 | /* Map tls/ssl alert value to correct one */ |
38b051a1 | 49 | if (SSL_CONNECTION_TREAT_AS_TLS13(s)) |
49e7fe12 MC |
50 | desc = tls13_alert_code(desc); |
51 | else | |
38b051a1 | 52 | desc = ssl->method->ssl3_enc->alert_value(desc); |
c103c7e2 MC |
53 | if (s->version == SSL3_VERSION && desc == SSL_AD_PROTOCOL_VERSION) |
54 | desc = SSL_AD_HANDSHAKE_FAILURE; /* SSL 3.0 does not have | |
55 | * protocol_version alerts */ | |
56 | if (desc < 0) | |
57 | return -1; | |
22d1138f DB |
58 | if (s->shutdown & SSL_SENT_SHUTDOWN && desc != SSL_AD_CLOSE_NOTIFY) |
59 | return -1; | |
c103c7e2 MC |
60 | /* If a fatal one, remove from cache */ |
61 | if ((level == SSL3_AL_FATAL) && (s->session != NULL)) | |
e2bb9b9b | 62 | SSL_CTX_remove_session(s->session_ctx, s->session); |
c103c7e2 | 63 | |
555cbb32 TS |
64 | s->s3.alert_dispatch = 1; |
65 | s->s3.send_alert[0] = level; | |
66 | s->s3.send_alert[1] = desc; | |
f161995e | 67 | if (!RECORD_LAYER_write_pending(&s->rlayer)) { |
c103c7e2 | 68 | /* data still being written out? */ |
38b051a1 | 69 | return ssl->method->ssl_dispatch_alert(ssl); |
c103c7e2 MC |
70 | } |
71 | /* | |
72 | * else data is still being written out, we will get written some time in | |
73 | * the future | |
74 | */ | |
75 | return -1; | |
76 | } | |
77 | ||
78 | int ssl3_dispatch_alert(SSL *s) | |
79 | { | |
80 | int i, j; | |
81 | void (*cb) (const SSL *ssl, int type, int val) = NULL; | |
38b051a1 | 82 | SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); |
a566864b | 83 | OSSL_RECORD_TEMPLATE templ; |
38b051a1 TM |
84 | |
85 | if (sc == NULL) | |
86 | return -1; | |
c103c7e2 | 87 | |
38b051a1 | 88 | sc->s3.alert_dispatch = 0; |
a566864b | 89 | |
b5cf81f7 MC |
90 | if (sc->rlayer.wrlmethod == NULL) { |
91 | /* No write record layer so we can't sent and alert. We just ignore it */ | |
92 | return 1; | |
93 | } | |
94 | ||
a566864b | 95 | templ.type = SSL3_RT_ALERT; |
1d367677 MC |
96 | templ.version = (sc->version == TLS1_3_VERSION) ? TLS1_2_VERSION |
97 | : sc->version; | |
98 | if (SSL_get_state(s) == TLS_ST_CW_CLNT_HELLO | |
99 | && !sc->renegotiate | |
100 | && TLS1_get_version(s) > TLS1_VERSION | |
101 | && sc->hello_retry_request == SSL_HRR_NONE) { | |
102 | templ.version = TLS1_VERSION; | |
103 | } | |
a566864b MC |
104 | templ.buf = &sc->s3.send_alert[0]; |
105 | templ.buflen = 2; | |
106 | ||
107 | /* TODO(RECLAYER): What happens if there is already a write pending? */ | |
108 | if (RECORD_LAYER_write_pending(&sc->rlayer)) | |
109 | return -1; | |
110 | ||
320145d5 MC |
111 | i = HANDLE_RLAYER_WRITE_RETURN(sc, |
112 | sc->rlayer.wrlmethod->write_records(sc->rlayer.wrl, &templ, 1)); | |
c103c7e2 | 113 | if (i <= 0) { |
38b051a1 | 114 | sc->s3.alert_dispatch = 1; |
c103c7e2 MC |
115 | } else { |
116 | /* | |
270d65fa TS |
117 | * Alert sent to BIO - now flush. If the message does not get sent due |
118 | * to non-blocking IO, we will not worry too much. | |
c103c7e2 | 119 | */ |
38b051a1 | 120 | (void)BIO_flush(sc->wbio); |
c103c7e2 | 121 | |
38b051a1 TM |
122 | if (sc->msg_callback) |
123 | sc->msg_callback(1, sc->version, SSL3_RT_ALERT, sc->s3.send_alert, | |
124 | 2, s, sc->msg_callback_arg); | |
c103c7e2 | 125 | |
38b051a1 TM |
126 | if (sc->info_callback != NULL) |
127 | cb = sc->info_callback; | |
c103c7e2 MC |
128 | else if (s->ctx->info_callback != NULL) |
129 | cb = s->ctx->info_callback; | |
130 | ||
131 | if (cb != NULL) { | |
38b051a1 | 132 | j = (sc->s3.send_alert[0] << 8) | sc->s3.send_alert[1]; |
c103c7e2 MC |
133 | cb(s, SSL_CB_WRITE_ALERT, j); |
134 | } | |
135 | } | |
7ee8627f | 136 | return i; |
c103c7e2 | 137 | } |