]>
Commit | Line | Data |
---|---|---|
f8e0a557 | 1 | /* |
fecb3aae | 2 | * Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved. |
f8e0a557 | 3 | * |
2c18d164 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
846e33c7 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
f8e0a557 MC |
8 | */ |
9 | ||
650c6687 RB |
10 | #if defined(__TANDEM) && defined(_SPT_MODEL_) |
11 | # include <spthread.h> | |
12 | # include <spt_extensions.h> /* timeval */ | |
13 | #endif | |
14 | ||
198c42f5 | 15 | #include "internal/cryptlib.h" |
07016a8a | 16 | #include <openssl/rand.h> |
706457b7 DMSP |
17 | #include "../ssl_local.h" |
18 | #include "statem_local.h" | |
f9f674eb | 19 | #include <assert.h> |
f8e0a557 MC |
20 | |
21 | /* | |
22 | * This file implements the SSL/TLS/DTLS state machines. | |
23 | * | |
24 | * There are two primary state machines: | |
25 | * | |
26 | * 1) Message flow state machine | |
27 | * 2) Handshake state machine | |
28 | * | |
29 | * The Message flow state machine controls the reading and sending of messages | |
30 | * including handling of non-blocking IO events, flushing of the underlying | |
31 | * write BIO, handling unexpected messages, etc. It is itself broken into two | |
32 | * separate sub-state machines which control reading and writing respectively. | |
33 | * | |
34 | * The Handshake state machine keeps track of the current SSL/TLS handshake | |
35 | * state. Transitions of the handshake state are the result of events that | |
36 | * occur within the Message flow state machine. | |
37 | * | |
38 | * Overall it looks like this: | |
39 | * | |
40 | * --------------------------------------------- ------------------- | |
41 | * | | | | | |
42 | * | Message flow state machine | | | | |
43 | * | | | | | |
44 | * | -------------------- -------------------- | Transition | Handshake state | | |
61ae935a | 45 | * | | MSG_FLOW_READING | | MSG_FLOW_WRITING | | Event | machine | |
f8e0a557 MC |
46 | * | | sub-state | | sub-state | |----------->| | |
47 | * | | machine for | | machine for | | | | | |
48 | * | | reading messages | | writing messages | | | | | |
49 | * | -------------------- -------------------- | | | | |
50 | * | | | | | |
51 | * --------------------------------------------- ------------------- | |
52 | * | |
53 | */ | |
54 | ||
55 | /* Sub state machine return values */ | |
a230b26e | 56 | typedef enum { |
f8e0a557 MC |
57 | /* Something bad happened or NBIO */ |
58 | SUB_STATE_ERROR, | |
59 | /* Sub state finished go to the next sub state */ | |
60 | SUB_STATE_FINISHED, | |
61 | /* Sub state finished and handshake was completed */ | |
62 | SUB_STATE_END_HANDSHAKE | |
d78052cf | 63 | } SUB_STATE_RETURN; |
f8e0a557 | 64 | |
38b051a1 TM |
65 | static int state_machine(SSL_CONNECTION *s, int server); |
66 | static void init_read_state_machine(SSL_CONNECTION *s); | |
67 | static SUB_STATE_RETURN read_state_machine(SSL_CONNECTION *s); | |
68 | static void init_write_state_machine(SSL_CONNECTION *s); | |
69 | static SUB_STATE_RETURN write_state_machine(SSL_CONNECTION *s); | |
49ae7423 | 70 | |
5998e290 | 71 | OSSL_HANDSHAKE_STATE SSL_get_state(const SSL *ssl) |
49ae7423 | 72 | { |
38b051a1 TM |
73 | const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl); |
74 | ||
75 | if (sc == NULL) | |
76 | return TLS_ST_BEFORE; | |
77 | ||
78 | return sc->statem.hand_state; | |
49ae7423 MC |
79 | } |
80 | ||
4cc968df | 81 | int SSL_in_init(const SSL *s) |
49ae7423 | 82 | { |
38b051a1 TM |
83 | const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); |
84 | ||
85 | if (sc == NULL) | |
86 | return 0; | |
87 | ||
88 | return sc->statem.in_init; | |
49ae7423 MC |
89 | } |
90 | ||
4cc968df | 91 | int SSL_is_init_finished(const SSL *s) |
49ae7423 | 92 | { |
38b051a1 TM |
93 | const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); |
94 | ||
95 | if (sc == NULL) | |
96 | return 0; | |
97 | ||
98 | return !(sc->statem.in_init) && (sc->statem.hand_state == TLS_ST_OK); | |
49ae7423 MC |
99 | } |
100 | ||
4cc968df | 101 | int SSL_in_before(const SSL *s) |
49ae7423 | 102 | { |
38b051a1 TM |
103 | const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s); |
104 | ||
105 | if (sc == NULL) | |
106 | return 0; | |
107 | ||
49ae7423 MC |
108 | /* |
109 | * Historically being "in before" meant before anything had happened. In the | |
110 | * current code though we remain in the "before" state for a while after we | |
111 | * have started the handshake process (e.g. as a server waiting for the | |
112 | * first message to arrive). There "in before" is taken to mean "in before" | |
113 | * and not started any handshake process yet. | |
114 | */ | |
38b051a1 TM |
115 | return (sc->statem.hand_state == TLS_ST_BEFORE) |
116 | && (sc->statem.state == MSG_FLOW_UNINITED); | |
49ae7423 MC |
117 | } |
118 | ||
846975f3 | 119 | OSSL_HANDSHAKE_STATE ossl_statem_get_state(SSL_CONNECTION *s) |
120 | { | |
121 | return s != NULL ? s->statem.hand_state : TLS_ST_BEFORE; | |
122 | } | |
123 | ||
f8e0a557 MC |
124 | /* |
125 | * Clear the state machine state and reset back to MSG_FLOW_UNINITED | |
126 | */ | |
38b051a1 | 127 | void ossl_statem_clear(SSL_CONNECTION *s) |
f8e0a557 MC |
128 | { |
129 | s->statem.state = MSG_FLOW_UNINITED; | |
49ae7423 | 130 | s->statem.hand_state = TLS_ST_BEFORE; |
bfc0f10d | 131 | ossl_statem_set_in_init(s, 1); |
a71a4966 | 132 | s->statem.no_cert_verify = 0; |
f8e0a557 MC |
133 | } |
134 | ||
135 | /* | |
136 | * Set the state machine up ready for a renegotiation handshake | |
137 | */ | |
38b051a1 | 138 | void ossl_statem_set_renegotiate(SSL_CONNECTION *s) |
f8e0a557 | 139 | { |
bfc0f10d | 140 | ossl_statem_set_in_init(s, 1); |
0386aad1 | 141 | s->statem.request_state = TLS_ST_SW_HELLO_REQ; |
f8e0a557 MC |
142 | } |
143 | ||
38b051a1 | 144 | void ossl_statem_send_fatal(SSL_CONNECTION *s, int al) |
5a2d0ef3 RL |
145 | { |
146 | /* We shouldn't call SSLfatal() twice. Once is enough */ | |
147 | if (s->statem.in_init && s->statem.state == MSG_FLOW_ERROR) | |
148 | return; | |
bfc0f10d | 149 | ossl_statem_set_in_init(s, 1); |
5a2d0ef3 | 150 | s->statem.state = MSG_FLOW_ERROR; |
4bf610bd | 151 | if (al != SSL_AD_NO_ALERT) |
5a2d0ef3 RL |
152 | ssl3_send_alert(s, SSL3_AL_FATAL, al); |
153 | } | |
154 | ||
f8e0a557 | 155 | /* |
e92519b5 RL |
156 | * Error reporting building block that's used instead of ERR_set_error(). |
157 | * In addition to what ERR_set_error() does, this puts the state machine | |
158 | * into an error state and sends an alert if appropriate. | |
1f359471 | 159 | * This is a permanent error for the current connection. |
f8e0a557 | 160 | */ |
38b051a1 TM |
161 | void ossl_statem_fatal(SSL_CONNECTION *s, int al, int reason, |
162 | const char *fmt, ...) | |
f8e0a557 | 163 | { |
e92519b5 RL |
164 | va_list args; |
165 | ||
166 | va_start(args, fmt); | |
167 | ERR_vset_error(ERR_LIB_SSL, reason, fmt, args); | |
168 | va_end(args); | |
169 | ||
5a2d0ef3 | 170 | ossl_statem_send_fatal(s, al); |
49ae7423 MC |
171 | } |
172 | ||
47e2ee07 MC |
173 | /* |
174 | * This macro should only be called if we are already expecting to be in | |
175 | * a fatal error state. We verify that we are, and set it if not (this would | |
176 | * indicate a bug). | |
177 | */ | |
c48ffbcc | 178 | #define check_fatal(s) \ |
47e2ee07 MC |
179 | do { \ |
180 | if (!ossl_assert((s)->statem.in_init \ | |
e1dd8fa0 | 181 | && (s)->statem.state == MSG_FLOW_ERROR)) \ |
c48ffbcc | 182 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_MISSING_FATAL); \ |
47e2ee07 MC |
183 | } while (0) |
184 | ||
49ae7423 MC |
185 | /* |
186 | * Discover whether the current connection is in the error state. | |
187 | * | |
188 | * Valid return values are: | |
189 | * 1: Yes | |
190 | * 0: No | |
191 | */ | |
38b051a1 | 192 | int ossl_statem_in_error(const SSL_CONNECTION *s) |
49ae7423 MC |
193 | { |
194 | if (s->statem.state == MSG_FLOW_ERROR) | |
195 | return 1; | |
196 | ||
197 | return 0; | |
198 | } | |
199 | ||
38b051a1 | 200 | void ossl_statem_set_in_init(SSL_CONNECTION *s, int init) |
49ae7423 MC |
201 | { |
202 | s->statem.in_init = init; | |
cffafb5f MC |
203 | if (s->rlayer.rrlmethod != NULL && s->rlayer.rrlmethod->set_in_init != NULL) |
204 | s->rlayer.rrlmethod->set_in_init(s->rlayer.rrl, init); | |
f8e0a557 MC |
205 | } |
206 | ||
38b051a1 | 207 | int ossl_statem_get_in_handshake(SSL_CONNECTION *s) |
024f543c MC |
208 | { |
209 | return s->statem.in_handshake; | |
210 | } | |
211 | ||
38b051a1 | 212 | void ossl_statem_set_in_handshake(SSL_CONNECTION *s, int inhand) |
024f543c MC |
213 | { |
214 | if (inhand) | |
215 | s->statem.in_handshake++; | |
216 | else | |
217 | s->statem.in_handshake--; | |
218 | } | |
219 | ||
0a87d0ac | 220 | /* Are we in a sensible state to skip over unreadable early data? */ |
38b051a1 | 221 | int ossl_statem_skip_early_data(SSL_CONNECTION *s) |
0a87d0ac | 222 | { |
1ea4d09a | 223 | if (s->ext.early_data != SSL_EARLY_DATA_REJECTED) |
0a87d0ac MC |
224 | return 0; |
225 | ||
1c1e4160 MC |
226 | if (!s->server |
227 | || s->statem.hand_state != TLS_ST_EARLY_DATA | |
228 | || s->hello_retry_request == SSL_HRR_COMPLETE) | |
d4504fe5 | 229 | return 0; |
0a87d0ac MC |
230 | |
231 | return 1; | |
232 | } | |
233 | ||
3eaa4170 MC |
234 | /* |
235 | * Called when we are in SSL_read*(), SSL_write*(), or SSL_accept() | |
236 | * /SSL_connect()/SSL_do_handshake(). Used to test whether we are in an early | |
237 | * data state and whether we should attempt to move the handshake on if so. | |
d1186c30 | 238 | * |sending| is 1 if we are attempting to send data (SSL_write*()), 0 if we are |
3eaa4170 MC |
239 | * attempting to read data (SSL_read*()), or -1 if we are in SSL_do_handshake() |
240 | * or similar. | |
241 | */ | |
38b051a1 | 242 | void ossl_statem_check_finish_init(SSL_CONNECTION *s, int sending) |
564547e4 | 243 | { |
d1186c30 | 244 | if (sending == -1) { |
3eaa4170 | 245 | if (s->statem.hand_state == TLS_ST_PENDING_EARLY_DATA_END |
ef6c191b | 246 | || s->statem.hand_state == TLS_ST_EARLY_DATA) { |
3eaa4170 | 247 | ossl_statem_set_in_init(s, 1); |
ef6c191b MC |
248 | if (s->early_data_state == SSL_EARLY_DATA_WRITE_RETRY) { |
249 | /* | |
250 | * SSL_connect() or SSL_do_handshake() has been called directly. | |
251 | * We don't allow any more writing of early data. | |
252 | */ | |
253 | s->early_data_state = SSL_EARLY_DATA_FINISHED_WRITING; | |
254 | } | |
255 | } | |
3eaa4170 | 256 | } else if (!s->server) { |
d1186c30 | 257 | if ((sending && (s->statem.hand_state == TLS_ST_PENDING_EARLY_DATA_END |
ef6c191b | 258 | || s->statem.hand_state == TLS_ST_EARLY_DATA) |
f7e393be | 259 | && s->early_data_state != SSL_EARLY_DATA_WRITING) |
d1186c30 | 260 | || (!sending && s->statem.hand_state == TLS_ST_EARLY_DATA)) { |
d7f8783f | 261 | ossl_statem_set_in_init(s, 1); |
ef6c191b MC |
262 | /* |
263 | * SSL_write() has been called directly. We don't allow any more | |
264 | * writing of early data. | |
265 | */ | |
d1186c30 | 266 | if (sending && s->early_data_state == SSL_EARLY_DATA_WRITE_RETRY) |
ef6c191b MC |
267 | s->early_data_state = SSL_EARLY_DATA_FINISHED_WRITING; |
268 | } | |
f7e393be MC |
269 | } else { |
270 | if (s->early_data_state == SSL_EARLY_DATA_FINISHED_READING | |
271 | && s->statem.hand_state == TLS_ST_EARLY_DATA) | |
272 | ossl_statem_set_in_init(s, 1); | |
d7f8783f | 273 | } |
564547e4 MC |
274 | } |
275 | ||
38b051a1 | 276 | void ossl_statem_set_hello_verify_done(SSL_CONNECTION *s) |
31fd10e6 MC |
277 | { |
278 | s->statem.state = MSG_FLOW_UNINITED; | |
bfc0f10d | 279 | ossl_statem_set_in_init(s, 1); |
31fd10e6 MC |
280 | /* |
281 | * This will get reset (briefly) back to TLS_ST_BEFORE when we enter | |
282 | * state_machine() because |state| is MSG_FLOW_UNINITED, but until then any | |
283 | * calls to SSL_in_before() will return false. Also calls to | |
284 | * SSL_state_string() and SSL_state_string_long() will return something | |
285 | * sensible. | |
286 | */ | |
287 | s->statem.hand_state = TLS_ST_SR_CLNT_HELLO; | |
288 | } | |
289 | ||
a230b26e EK |
290 | int ossl_statem_connect(SSL *s) |
291 | { | |
38b051a1 TM |
292 | SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); |
293 | ||
294 | if (sc == NULL) | |
295 | return -1; | |
296 | ||
297 | return state_machine(sc, 0); | |
8723588e MC |
298 | } |
299 | ||
fe3a3291 | 300 | int ossl_statem_accept(SSL *s) |
c130dd8e | 301 | { |
38b051a1 TM |
302 | SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); |
303 | ||
304 | if (sc == NULL) | |
305 | return -1; | |
306 | ||
307 | return state_machine(sc, 1); | |
c130dd8e MC |
308 | } |
309 | ||
a230b26e EK |
310 | typedef void (*info_cb) (const SSL *, int, int); |
311 | ||
38b051a1 | 312 | static info_cb get_callback(SSL_CONNECTION *s) |
91eac8d5 | 313 | { |
38b051a1 TM |
314 | SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s); |
315 | ||
91eac8d5 MC |
316 | if (s->info_callback != NULL) |
317 | return s->info_callback; | |
38b051a1 TM |
318 | else if (sctx->info_callback != NULL) |
319 | return sctx->info_callback; | |
91eac8d5 MC |
320 | |
321 | return NULL; | |
322 | } | |
323 | ||
f8e0a557 MC |
324 | /* |
325 | * The main message flow state machine. We start in the MSG_FLOW_UNINITED or | |
c7f47786 | 326 | * MSG_FLOW_FINISHED state and finish in MSG_FLOW_FINISHED. Valid states and |
f8e0a557 MC |
327 | * transitions are as follows: |
328 | * | |
c7f47786 | 329 | * MSG_FLOW_UNINITED MSG_FLOW_FINISHED |
f8e0a557 MC |
330 | * | | |
331 | * +-----------------------+ | |
332 | * v | |
333 | * MSG_FLOW_WRITING <---> MSG_FLOW_READING | |
334 | * | | |
335 | * V | |
336 | * MSG_FLOW_FINISHED | |
337 | * | | |
338 | * V | |
339 | * [SUCCESS] | |
340 | * | |
341 | * We may exit at any point due to an error or NBIO event. If an NBIO event | |
342 | * occurs then we restart at the point we left off when we are recalled. | |
343 | * MSG_FLOW_WRITING and MSG_FLOW_READING have sub-state machines associated with them. | |
344 | * | |
345 | * In addition to the above there is also the MSG_FLOW_ERROR state. We can move | |
346 | * into that state at any point in the event that an irrecoverable error occurs. | |
347 | * | |
348 | * Valid return values are: | |
349 | * 1: Success | |
350 | * <=0: NBIO or error | |
351 | */ | |
38b051a1 | 352 | static int state_machine(SSL_CONNECTION *s, int server) |
4fa52141 | 353 | { |
f8e0a557 | 354 | BUF_MEM *buf = NULL; |
f8e0a557 | 355 | void (*cb) (const SSL *ssl, int type, int val) = NULL; |
d6f1a6e9 | 356 | OSSL_STATEM *st = &s->statem; |
f8e0a557 MC |
357 | int ret = -1; |
358 | int ssret; | |
38b051a1 | 359 | SSL *ssl = SSL_CONNECTION_GET_SSL(s); |
f8e0a557 MC |
360 | |
361 | if (st->state == MSG_FLOW_ERROR) { | |
362 | /* Shouldn't have been called if we're already in the error state */ | |
363 | return -1; | |
364 | } | |
365 | ||
f8e0a557 MC |
366 | ERR_clear_error(); |
367 | clear_sys_error(); | |
368 | ||
91eac8d5 | 369 | cb = get_callback(s); |
f8e0a557 | 370 | |
024f543c | 371 | st->in_handshake++; |
38b051a1 | 372 | if (!SSL_in_init(ssl) || SSL_in_before(ssl)) { |
808d1601 MC |
373 | /* |
374 | * If we are stateless then we already called SSL_clear() - don't do | |
375 | * it again and clear the STATELESS flag itself. | |
376 | */ | |
38b051a1 | 377 | if ((s->s3.flags & TLS1_FLAGS_STATELESS) == 0 && !SSL_clear(ssl)) |
f8e0a557 MC |
378 | return -1; |
379 | } | |
473483d4 | 380 | #ifndef OPENSSL_NO_SCTP |
38b051a1 | 381 | if (SSL_CONNECTION_IS_DTLS(s) && BIO_dgram_is_sctp(SSL_get_wbio(ssl))) { |
473483d4 MC |
382 | /* |
383 | * Notify SCTP BIO socket to enter handshake mode and prevent stream | |
99240875 | 384 | * identifier other than 0. |
473483d4 | 385 | */ |
38b051a1 | 386 | BIO_ctrl(SSL_get_wbio(ssl), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE, |
024f543c | 387 | st->in_handshake, NULL); |
473483d4 MC |
388 | } |
389 | #endif | |
390 | ||
f8e0a557 | 391 | /* Initialise state machine */ |
0386aad1 | 392 | if (st->state == MSG_FLOW_UNINITED |
0386aad1 | 393 | || st->state == MSG_FLOW_FINISHED) { |
f8e0a557 MC |
394 | if (st->state == MSG_FLOW_UNINITED) { |
395 | st->hand_state = TLS_ST_BEFORE; | |
0386aad1 | 396 | st->request_state = TLS_ST_BEFORE; |
f8e0a557 MC |
397 | } |
398 | ||
399 | s->server = server; | |
4af5836b | 400 | if (cb != NULL) { |
38b051a1 TM |
401 | if (SSL_IS_FIRST_HANDSHAKE(s) || !SSL_CONNECTION_IS_TLS13(s)) |
402 | cb(ssl, SSL_CB_HANDSHAKE_START, 1); | |
4af5836b | 403 | } |
f8e0a557 | 404 | |
47e2ee07 MC |
405 | /* |
406 | * Fatal errors in this block don't send an alert because we have | |
407 | * failed to even initialise properly. Sending an alert is probably | |
408 | * doomed to failure. | |
409 | */ | |
410 | ||
38b051a1 | 411 | if (SSL_CONNECTION_IS_DTLS(s)) { |
f8e0a557 | 412 | if ((s->version & 0xff00) != (DTLS1_VERSION & 0xff00) && |
a230b26e | 413 | (server || (s->version & 0xff00) != (DTLS1_BAD_VER & 0xff00))) { |
c48ffbcc | 414 | SSLfatal(s, SSL_AD_NO_ALERT, ERR_R_INTERNAL_ERROR); |
f8e0a557 MC |
415 | goto end; |
416 | } | |
417 | } else { | |
4fa52141 | 418 | if ((s->version >> 8) != SSL3_VERSION_MAJOR) { |
c48ffbcc | 419 | SSLfatal(s, SSL_AD_NO_ALERT, ERR_R_INTERNAL_ERROR); |
f8e0a557 MC |
420 | goto end; |
421 | } | |
422 | } | |
423 | ||
4fa52141 | 424 | if (!ssl_security(s, SSL_SECOP_VERSION, 0, s->version, NULL)) { |
c48ffbcc | 425 | SSLfatal(s, SSL_AD_NO_ALERT, ERR_R_INTERNAL_ERROR); |
4fa52141 | 426 | goto end; |
f8e0a557 MC |
427 | } |
428 | ||
f8e0a557 MC |
429 | if (s->init_buf == NULL) { |
430 | if ((buf = BUF_MEM_new()) == NULL) { | |
c48ffbcc | 431 | SSLfatal(s, SSL_AD_NO_ALERT, ERR_R_INTERNAL_ERROR); |
f8e0a557 MC |
432 | goto end; |
433 | } | |
434 | if (!BUF_MEM_grow(buf, SSL3_RT_MAX_PLAIN_LENGTH)) { | |
c48ffbcc | 435 | SSLfatal(s, SSL_AD_NO_ALERT, ERR_R_INTERNAL_ERROR); |
f8e0a557 MC |
436 | goto end; |
437 | } | |
438 | s->init_buf = buf; | |
439 | buf = NULL; | |
440 | } | |
441 | ||
f8e0a557 MC |
442 | s->init_num = 0; |
443 | ||
444 | /* | |
445 | * Should have been reset by tls_process_finished, too. | |
446 | */ | |
555cbb32 | 447 | s->s3.change_cipher_spec = 0; |
f8e0a557 | 448 | |
46417569 MC |
449 | /* |
450 | * Ok, we now need to push on a buffering BIO ...but not with | |
451 | * SCTP | |
452 | */ | |
f8e0a557 | 453 | #ifndef OPENSSL_NO_SCTP |
38b051a1 | 454 | if (!SSL_CONNECTION_IS_DTLS(s) || !BIO_dgram_is_sctp(SSL_get_wbio(ssl))) |
f8e0a557 | 455 | #endif |
46417569 | 456 | if (!ssl_init_wbio_buffer(s)) { |
c48ffbcc | 457 | SSLfatal(s, SSL_AD_NO_ALERT, ERR_R_INTERNAL_ERROR); |
46417569 MC |
458 | goto end; |
459 | } | |
f8e0a557 | 460 | |
38b051a1 | 461 | if ((SSL_in_before(ssl)) |
49e7fe12 | 462 | || s->renegotiate) { |
47e2ee07 MC |
463 | if (!tls_setup_handshake(s)) { |
464 | /* SSLfatal() already called */ | |
c7f47786 | 465 | goto end; |
47e2ee07 | 466 | } |
0386aad1 | 467 | |
c7f47786 MC |
468 | if (SSL_IS_FIRST_HANDSHAKE(s)) |
469 | st->read_state_first_init = 1; | |
f8e0a557 MC |
470 | } |
471 | ||
472 | st->state = MSG_FLOW_WRITING; | |
473 | init_write_state_machine(s); | |
f8e0a557 MC |
474 | } |
475 | ||
e8aa8b6c F |
476 | while (st->state != MSG_FLOW_FINISHED) { |
477 | if (st->state == MSG_FLOW_READING) { | |
f8e0a557 MC |
478 | ssret = read_state_machine(s); |
479 | if (ssret == SUB_STATE_FINISHED) { | |
480 | st->state = MSG_FLOW_WRITING; | |
481 | init_write_state_machine(s); | |
482 | } else { | |
483 | /* NBIO or error */ | |
484 | goto end; | |
485 | } | |
486 | } else if (st->state == MSG_FLOW_WRITING) { | |
487 | ssret = write_state_machine(s); | |
488 | if (ssret == SUB_STATE_FINISHED) { | |
489 | st->state = MSG_FLOW_READING; | |
490 | init_read_state_machine(s); | |
491 | } else if (ssret == SUB_STATE_END_HANDSHAKE) { | |
492 | st->state = MSG_FLOW_FINISHED; | |
493 | } else { | |
494 | /* NBIO or error */ | |
495 | goto end; | |
496 | } | |
497 | } else { | |
498 | /* Error */ | |
c48ffbcc | 499 | check_fatal(s); |
6849b73c | 500 | ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); |
f8e0a557 MC |
501 | goto end; |
502 | } | |
503 | } | |
504 | ||
f8e0a557 MC |
505 | ret = 1; |
506 | ||
507 | end: | |
024f543c | 508 | st->in_handshake--; |
473483d4 MC |
509 | |
510 | #ifndef OPENSSL_NO_SCTP | |
38b051a1 | 511 | if (SSL_CONNECTION_IS_DTLS(s) && BIO_dgram_is_sctp(SSL_get_wbio(ssl))) { |
473483d4 MC |
512 | /* |
513 | * Notify SCTP BIO socket to leave handshake mode and allow stream | |
99240875 | 514 | * identifier other than 0. |
473483d4 | 515 | */ |
38b051a1 | 516 | BIO_ctrl(SSL_get_wbio(ssl), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE, |
024f543c | 517 | st->in_handshake, NULL); |
473483d4 MC |
518 | } |
519 | #endif | |
520 | ||
f8e0a557 MC |
521 | BUF_MEM_free(buf); |
522 | if (cb != NULL) { | |
523 | if (server) | |
38b051a1 | 524 | cb(ssl, SSL_CB_ACCEPT_EXIT, ret); |
f8e0a557 | 525 | else |
38b051a1 | 526 | cb(ssl, SSL_CB_CONNECT_EXIT, ret); |
f8e0a557 MC |
527 | } |
528 | return ret; | |
529 | } | |
530 | ||
531 | /* | |
532 | * Initialise the MSG_FLOW_READING sub-state machine | |
533 | */ | |
38b051a1 | 534 | static void init_read_state_machine(SSL_CONNECTION *s) |
f8e0a557 | 535 | { |
d6f1a6e9 | 536 | OSSL_STATEM *st = &s->statem; |
f8e0a557 MC |
537 | |
538 | st->read_state = READ_STATE_HEADER; | |
539 | } | |
540 | ||
38b051a1 | 541 | static int grow_init_buf(SSL_CONNECTION *s, size_t size) { |
0d698f66 MC |
542 | |
543 | size_t msg_offset = (char *)s->init_msg - s->init_buf->data; | |
544 | ||
545 | if (!BUF_MEM_grow_clean(s->init_buf, (int)size)) | |
546 | return 0; | |
547 | ||
548 | if (size < msg_offset) | |
549 | return 0; | |
550 | ||
551 | s->init_msg = s->init_buf->data + msg_offset; | |
552 | ||
553 | return 1; | |
554 | } | |
555 | ||
f8e0a557 MC |
556 | /* |
557 | * This function implements the sub-state machine when the message flow is in | |
558 | * MSG_FLOW_READING. The valid sub-states and transitions are: | |
559 | * | |
560 | * READ_STATE_HEADER <--+<-------------+ | |
561 | * | | | | |
562 | * v | | | |
563 | * READ_STATE_BODY -----+-->READ_STATE_POST_PROCESS | |
564 | * | | | |
565 | * +----------------------------+ | |
566 | * v | |
567 | * [SUB_STATE_FINISHED] | |
568 | * | |
569 | * READ_STATE_HEADER has the responsibility for reading in the message header | |
570 | * and transitioning the state of the handshake state machine. | |
571 | * | |
572 | * READ_STATE_BODY reads in the rest of the message and then subsequently | |
573 | * processes it. | |
574 | * | |
575 | * READ_STATE_POST_PROCESS is an optional step that may occur if some post | |
576 | * processing activity performed on the message may block. | |
577 | * | |
0d4fb843 | 578 | * Any of the above states could result in an NBIO event occurring in which case |
f8e0a557 MC |
579 | * control returns to the calling application. When this function is recalled we |
580 | * will resume in the same state where we left off. | |
581 | */ | |
38b051a1 | 582 | static SUB_STATE_RETURN read_state_machine(SSL_CONNECTION *s) |
a230b26e | 583 | { |
d6f1a6e9 | 584 | OSSL_STATEM *st = &s->statem; |
f8e0a557 | 585 | int ret, mt; |
eda75751 | 586 | size_t len = 0; |
38b051a1 | 587 | int (*transition) (SSL_CONNECTION *s, int mt); |
73999b62 | 588 | PACKET pkt; |
38b051a1 TM |
589 | MSG_PROCESS_RETURN(*process_message) (SSL_CONNECTION *s, PACKET *pkt); |
590 | WORK_STATE(*post_process_message) (SSL_CONNECTION *s, WORK_STATE wst); | |
591 | size_t (*max_message_size) (SSL_CONNECTION *s); | |
f8e0a557 | 592 | void (*cb) (const SSL *ssl, int type, int val) = NULL; |
38b051a1 | 593 | SSL *ssl = SSL_CONNECTION_GET_SSL(s); |
f8e0a557 | 594 | |
91eac8d5 | 595 | cb = get_callback(s); |
f8e0a557 | 596 | |
e8aa8b6c | 597 | if (s->server) { |
8481f583 MC |
598 | transition = ossl_statem_server_read_transition; |
599 | process_message = ossl_statem_server_process_message; | |
600 | max_message_size = ossl_statem_server_max_message_size; | |
601 | post_process_message = ossl_statem_server_post_process_message; | |
f8e0a557 | 602 | } else { |
8481f583 MC |
603 | transition = ossl_statem_client_read_transition; |
604 | process_message = ossl_statem_client_process_message; | |
605 | max_message_size = ossl_statem_client_max_message_size; | |
606 | post_process_message = ossl_statem_client_post_process_message; | |
f8e0a557 MC |
607 | } |
608 | ||
609 | if (st->read_state_first_init) { | |
610 | s->first_packet = 1; | |
611 | st->read_state_first_init = 0; | |
612 | } | |
613 | ||
e8aa8b6c F |
614 | while (1) { |
615 | switch (st->read_state) { | |
f8e0a557 | 616 | case READ_STATE_HEADER: |
f8e0a557 | 617 | /* Get the state the peer wants to move to */ |
38b051a1 | 618 | if (SSL_CONNECTION_IS_DTLS(s)) { |
76af3037 MC |
619 | /* |
620 | * In DTLS we get the whole message in one go - header and body | |
621 | */ | |
f42e68dc | 622 | ret = dtls_get_message(s, &mt); |
76af3037 MC |
623 | } else { |
624 | ret = tls_get_message_header(s, &mt); | |
625 | } | |
f8e0a557 MC |
626 | |
627 | if (ret == 0) { | |
628 | /* Could be non-blocking IO */ | |
629 | return SUB_STATE_ERROR; | |
630 | } | |
631 | ||
632 | if (cb != NULL) { | |
633 | /* Notify callback of an impending state change */ | |
634 | if (s->server) | |
38b051a1 | 635 | cb(ssl, SSL_CB_ACCEPT_LOOP, 1); |
f8e0a557 | 636 | else |
38b051a1 | 637 | cb(ssl, SSL_CB_CONNECT_LOOP, 1); |
f8e0a557 MC |
638 | } |
639 | /* | |
640 | * Validate that we are allowed to move to the new state and move | |
641 | * to that state if so | |
642 | */ | |
f20404fc | 643 | if (!transition(s, mt)) |
f8e0a557 | 644 | return SUB_STATE_ERROR; |
f8e0a557 | 645 | |
555cbb32 | 646 | if (s->s3.tmp.message_size > max_message_size(s)) { |
c48ffbcc | 647 | SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, |
f63a17d6 | 648 | SSL_R_EXCESSIVE_MESSAGE_SIZE); |
f8e0a557 MC |
649 | return SUB_STATE_ERROR; |
650 | } | |
651 | ||
c1ef7c97 | 652 | /* dtls_get_message already did this */ |
38b051a1 | 653 | if (!SSL_CONNECTION_IS_DTLS(s) |
555cbb32 TS |
654 | && s->s3.tmp.message_size > 0 |
655 | && !grow_init_buf(s, s->s3.tmp.message_size | |
0d698f66 | 656 | + SSL3_HM_HEADER_LENGTH)) { |
c48ffbcc | 657 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_BUF_LIB); |
c1ef7c97 MC |
658 | return SUB_STATE_ERROR; |
659 | } | |
660 | ||
f8e0a557 MC |
661 | st->read_state = READ_STATE_BODY; |
662 | /* Fall through */ | |
663 | ||
664 | case READ_STATE_BODY: | |
38b051a1 | 665 | if (SSL_CONNECTION_IS_DTLS(s)) { |
f42e68dc MC |
666 | /* |
667 | * Actually we already have the body, but we give DTLS the | |
668 | * opportunity to do any further processing. | |
669 | */ | |
670 | ret = dtls_get_message_body(s, &len); | |
671 | } else { | |
f8e0a557 | 672 | ret = tls_get_message_body(s, &len); |
f42e68dc MC |
673 | } |
674 | if (ret == 0) { | |
675 | /* Could be non-blocking IO */ | |
676 | return SUB_STATE_ERROR; | |
f8e0a557 MC |
677 | } |
678 | ||
679 | s->first_packet = 0; | |
73999b62 | 680 | if (!PACKET_buf_init(&pkt, s->init_msg, len)) { |
c48ffbcc | 681 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
73999b62 MC |
682 | return SUB_STATE_ERROR; |
683 | } | |
684 | ret = process_message(s, &pkt); | |
1689e7e6 MC |
685 | |
686 | /* Discard the packet data */ | |
687 | s->init_num = 0; | |
688 | ||
4f8a5f4d AG |
689 | switch (ret) { |
690 | case MSG_PROCESS_ERROR: | |
c48ffbcc | 691 | check_fatal(s); |
f8e0a557 | 692 | return SUB_STATE_ERROR; |
f8e0a557 | 693 | |
4f8a5f4d | 694 | case MSG_PROCESS_FINISHED_READING: |
38b051a1 | 695 | if (SSL_CONNECTION_IS_DTLS(s)) { |
f8e0a557 MC |
696 | dtls1_stop_timer(s); |
697 | } | |
698 | return SUB_STATE_FINISHED; | |
f8e0a557 | 699 | |
4f8a5f4d | 700 | case MSG_PROCESS_CONTINUE_PROCESSING: |
f8e0a557 MC |
701 | st->read_state = READ_STATE_POST_PROCESS; |
702 | st->read_state_work = WORK_MORE_A; | |
4f8a5f4d AG |
703 | break; |
704 | ||
705 | default: | |
f8e0a557 | 706 | st->read_state = READ_STATE_HEADER; |
4f8a5f4d | 707 | break; |
f8e0a557 MC |
708 | } |
709 | break; | |
710 | ||
711 | case READ_STATE_POST_PROCESS: | |
712 | st->read_state_work = post_process_message(s, st->read_state_work); | |
e8aa8b6c | 713 | switch (st->read_state_work) { |
f3b3d7f0 | 714 | case WORK_ERROR: |
c48ffbcc | 715 | check_fatal(s); |
47e2ee07 | 716 | /* Fall through */ |
f3b3d7f0 RS |
717 | case WORK_MORE_A: |
718 | case WORK_MORE_B: | |
ddf97258 | 719 | case WORK_MORE_C: |
f8e0a557 MC |
720 | return SUB_STATE_ERROR; |
721 | ||
722 | case WORK_FINISHED_CONTINUE: | |
723 | st->read_state = READ_STATE_HEADER; | |
724 | break; | |
725 | ||
726 | case WORK_FINISHED_STOP: | |
38b051a1 | 727 | if (SSL_CONNECTION_IS_DTLS(s)) { |
f8e0a557 MC |
728 | dtls1_stop_timer(s); |
729 | } | |
730 | return SUB_STATE_FINISHED; | |
731 | } | |
732 | break; | |
733 | ||
734 | default: | |
735 | /* Shouldn't happen */ | |
c48ffbcc | 736 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
f8e0a557 MC |
737 | return SUB_STATE_ERROR; |
738 | } | |
739 | } | |
740 | } | |
741 | ||
742 | /* | |
743 | * Send a previously constructed message to the peer. | |
744 | */ | |
38b051a1 | 745 | static int statem_do_write(SSL_CONNECTION *s) |
f8e0a557 | 746 | { |
d6f1a6e9 | 747 | OSSL_STATEM *st = &s->statem; |
f8e0a557 MC |
748 | |
749 | if (st->hand_state == TLS_ST_CW_CHANGE | |
a230b26e | 750 | || st->hand_state == TLS_ST_SW_CHANGE) { |
38b051a1 | 751 | if (SSL_CONNECTION_IS_DTLS(s)) |
f8e0a557 MC |
752 | return dtls1_do_write(s, SSL3_RT_CHANGE_CIPHER_SPEC); |
753 | else | |
754 | return ssl3_do_write(s, SSL3_RT_CHANGE_CIPHER_SPEC); | |
755 | } else { | |
756 | return ssl_do_write(s); | |
757 | } | |
758 | } | |
759 | ||
760 | /* | |
761 | * Initialise the MSG_FLOW_WRITING sub-state machine | |
762 | */ | |
38b051a1 | 763 | static void init_write_state_machine(SSL_CONNECTION *s) |
f8e0a557 | 764 | { |
d6f1a6e9 | 765 | OSSL_STATEM *st = &s->statem; |
f8e0a557 MC |
766 | |
767 | st->write_state = WRITE_STATE_TRANSITION; | |
768 | } | |
769 | ||
770 | /* | |
771 | * This function implements the sub-state machine when the message flow is in | |
772 | * MSG_FLOW_WRITING. The valid sub-states and transitions are: | |
773 | * | |
774 | * +-> WRITE_STATE_TRANSITION ------> [SUB_STATE_FINISHED] | |
775 | * | | | |
776 | * | v | |
777 | * | WRITE_STATE_PRE_WORK -----> [SUB_STATE_END_HANDSHAKE] | |
778 | * | | | |
779 | * | v | |
780 | * | WRITE_STATE_SEND | |
781 | * | | | |
782 | * | v | |
783 | * | WRITE_STATE_POST_WORK | |
784 | * | | | |
785 | * +-------------+ | |
786 | * | |
787 | * WRITE_STATE_TRANSITION transitions the state of the handshake state machine | |
788 | ||
789 | * WRITE_STATE_PRE_WORK performs any work necessary to prepare the later | |
0d4fb843 | 790 | * sending of the message. This could result in an NBIO event occurring in |
f8e0a557 MC |
791 | * which case control returns to the calling application. When this function |
792 | * is recalled we will resume in the same state where we left off. | |
793 | * | |
794 | * WRITE_STATE_SEND sends the message and performs any work to be done after | |
795 | * sending. | |
796 | * | |
797 | * WRITE_STATE_POST_WORK performs any work necessary after the sending of the | |
798 | * message has been completed. As for WRITE_STATE_PRE_WORK this could also | |
799 | * result in an NBIO event. | |
800 | */ | |
38b051a1 | 801 | static SUB_STATE_RETURN write_state_machine(SSL_CONNECTION *s) |
f8e0a557 | 802 | { |
d6f1a6e9 | 803 | OSSL_STATEM *st = &s->statem; |
f8e0a557 | 804 | int ret; |
38b051a1 TM |
805 | WRITE_TRAN(*transition) (SSL_CONNECTION *s); |
806 | WORK_STATE(*pre_work) (SSL_CONNECTION *s, WORK_STATE wst); | |
807 | WORK_STATE(*post_work) (SSL_CONNECTION *s, WORK_STATE wst); | |
808 | int (*get_construct_message_f) (SSL_CONNECTION *s, | |
67ec6d2b MC |
809 | CON_FUNC_RETURN (**confunc) (SSL_CONNECTION *s, |
810 | WPACKET *pkt), | |
6392fb8e | 811 | int *mt); |
f8e0a557 | 812 | void (*cb) (const SSL *ssl, int type, int val) = NULL; |
67ec6d2b | 813 | CON_FUNC_RETURN (*confunc) (SSL_CONNECTION *s, WPACKET *pkt); |
6392fb8e | 814 | int mt; |
7cea05dc | 815 | WPACKET pkt; |
38b051a1 | 816 | SSL *ssl = SSL_CONNECTION_GET_SSL(s); |
f8e0a557 | 817 | |
91eac8d5 | 818 | cb = get_callback(s); |
f8e0a557 | 819 | |
e8aa8b6c | 820 | if (s->server) { |
8481f583 MC |
821 | transition = ossl_statem_server_write_transition; |
822 | pre_work = ossl_statem_server_pre_work; | |
823 | post_work = ossl_statem_server_post_work; | |
6392fb8e | 824 | get_construct_message_f = ossl_statem_server_construct_message; |
f8e0a557 | 825 | } else { |
8481f583 MC |
826 | transition = ossl_statem_client_write_transition; |
827 | pre_work = ossl_statem_client_pre_work; | |
828 | post_work = ossl_statem_client_post_work; | |
6392fb8e | 829 | get_construct_message_f = ossl_statem_client_construct_message; |
f8e0a557 MC |
830 | } |
831 | ||
e8aa8b6c F |
832 | while (1) { |
833 | switch (st->write_state) { | |
f8e0a557 MC |
834 | case WRITE_STATE_TRANSITION: |
835 | if (cb != NULL) { | |
836 | /* Notify callback of an impending state change */ | |
837 | if (s->server) | |
38b051a1 | 838 | cb(ssl, SSL_CB_ACCEPT_LOOP, 1); |
f8e0a557 | 839 | else |
38b051a1 | 840 | cb(ssl, SSL_CB_CONNECT_LOOP, 1); |
f8e0a557 | 841 | } |
e8aa8b6c | 842 | switch (transition(s)) { |
f8e0a557 MC |
843 | case WRITE_TRAN_CONTINUE: |
844 | st->write_state = WRITE_STATE_PRE_WORK; | |
845 | st->write_state_work = WORK_MORE_A; | |
846 | break; | |
847 | ||
848 | case WRITE_TRAN_FINISHED: | |
849 | return SUB_STATE_FINISHED; | |
850 | break; | |
851 | ||
f3b3d7f0 | 852 | case WRITE_TRAN_ERROR: |
c48ffbcc | 853 | check_fatal(s); |
f8e0a557 MC |
854 | return SUB_STATE_ERROR; |
855 | } | |
856 | break; | |
857 | ||
858 | case WRITE_STATE_PRE_WORK: | |
e8aa8b6c | 859 | switch (st->write_state_work = pre_work(s, st->write_state_work)) { |
f3b3d7f0 | 860 | case WORK_ERROR: |
c48ffbcc | 861 | check_fatal(s); |
47e2ee07 | 862 | /* Fall through */ |
f3b3d7f0 RS |
863 | case WORK_MORE_A: |
864 | case WORK_MORE_B: | |
ddf97258 | 865 | case WORK_MORE_C: |
f8e0a557 MC |
866 | return SUB_STATE_ERROR; |
867 | ||
868 | case WORK_FINISHED_CONTINUE: | |
869 | st->write_state = WRITE_STATE_SEND; | |
870 | break; | |
871 | ||
872 | case WORK_FINISHED_STOP: | |
873 | return SUB_STATE_END_HANDSHAKE; | |
874 | } | |
e1c12271 | 875 | if (!get_construct_message_f(s, &confunc, &mt)) { |
f63a17d6 | 876 | /* SSLfatal() already called */ |
f7e393be MC |
877 | return SUB_STATE_ERROR; |
878 | } | |
879 | if (mt == SSL3_MT_DUMMY) { | |
880 | /* Skip construction and sending. This isn't a "real" state */ | |
881 | st->write_state = WRITE_STATE_POST_WORK; | |
882 | st->write_state_work = WORK_MORE_A; | |
883 | break; | |
884 | } | |
7cea05dc | 885 | if (!WPACKET_init(&pkt, s->init_buf) |
f63a17d6 MC |
886 | || !ssl_set_handshake_header(s, &pkt, mt)) { |
887 | WPACKET_cleanup(&pkt); | |
c48ffbcc | 888 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
f63a17d6 MC |
889 | return SUB_STATE_ERROR; |
890 | } | |
3e93c5fe | 891 | if (confunc != NULL) { |
67ec6d2b | 892 | CON_FUNC_RETURN tmpret; |
3e93c5fe MC |
893 | |
894 | tmpret = confunc(s, &pkt); | |
67ec6d2b | 895 | if (tmpret == CON_FUNC_ERROR) { |
3e93c5fe MC |
896 | WPACKET_cleanup(&pkt); |
897 | check_fatal(s); | |
898 | return SUB_STATE_ERROR; | |
67ec6d2b | 899 | } else if (tmpret == CON_FUNC_DONT_SEND) { |
3e93c5fe MC |
900 | /* |
901 | * The construction function decided not to construct the | |
902 | * message after all and continue. Skip sending. | |
903 | */ | |
904 | WPACKET_cleanup(&pkt); | |
905 | st->write_state = WRITE_STATE_POST_WORK; | |
906 | st->write_state_work = WORK_MORE_A; | |
907 | break; | |
908 | } /* else success */ | |
f63a17d6 MC |
909 | } |
910 | if (!ssl_close_construct_packet(s, &pkt, mt) | |
7cea05dc MC |
911 | || !WPACKET_finish(&pkt)) { |
912 | WPACKET_cleanup(&pkt); | |
c48ffbcc | 913 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
f8e0a557 | 914 | return SUB_STATE_ERROR; |
7cea05dc | 915 | } |
f8e0a557 MC |
916 | |
917 | /* Fall through */ | |
918 | ||
919 | case WRITE_STATE_SEND: | |
38b051a1 | 920 | if (SSL_CONNECTION_IS_DTLS(s) && st->use_timer) { |
f8e0a557 MC |
921 | dtls1_start_timer(s); |
922 | } | |
923 | ret = statem_do_write(s); | |
924 | if (ret <= 0) { | |
925 | return SUB_STATE_ERROR; | |
926 | } | |
927 | st->write_state = WRITE_STATE_POST_WORK; | |
928 | st->write_state_work = WORK_MORE_A; | |
929 | /* Fall through */ | |
930 | ||
931 | case WRITE_STATE_POST_WORK: | |
e8aa8b6c | 932 | switch (st->write_state_work = post_work(s, st->write_state_work)) { |
f3b3d7f0 | 933 | case WORK_ERROR: |
c48ffbcc | 934 | check_fatal(s); |
47e2ee07 | 935 | /* Fall through */ |
f3b3d7f0 RS |
936 | case WORK_MORE_A: |
937 | case WORK_MORE_B: | |
ddf97258 | 938 | case WORK_MORE_C: |
f8e0a557 MC |
939 | return SUB_STATE_ERROR; |
940 | ||
941 | case WORK_FINISHED_CONTINUE: | |
942 | st->write_state = WRITE_STATE_TRANSITION; | |
943 | break; | |
944 | ||
945 | case WORK_FINISHED_STOP: | |
946 | return SUB_STATE_END_HANDSHAKE; | |
947 | } | |
948 | break; | |
949 | ||
950 | default: | |
c48ffbcc | 951 | SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); |
f8e0a557 MC |
952 | return SUB_STATE_ERROR; |
953 | } | |
954 | } | |
955 | } | |
956 | ||
8723588e MC |
957 | /* |
958 | * Flush the write BIO | |
959 | */ | |
38b051a1 | 960 | int statem_flush(SSL_CONNECTION *s) |
8723588e MC |
961 | { |
962 | s->rwstate = SSL_WRITING; | |
963 | if (BIO_flush(s->wbio) <= 0) { | |
964 | return 0; | |
965 | } | |
966 | s->rwstate = SSL_NOTHING; | |
967 | ||
968 | return 1; | |
969 | } | |
970 | ||
f8e0a557 MC |
971 | /* |
972 | * Called by the record layer to determine whether application data is | |
c7f47786 | 973 | * allowed to be received in the current handshake state or not. |
f8e0a557 MC |
974 | * |
975 | * Return values are: | |
976 | * 1: Yes (application data allowed) | |
977 | * 0: No (application data not allowed) | |
978 | */ | |
38b051a1 | 979 | int ossl_statem_app_data_allowed(SSL_CONNECTION *s) |
f8e0a557 | 980 | { |
d6f1a6e9 | 981 | OSSL_STATEM *st = &s->statem; |
f8e0a557 | 982 | |
c7f47786 | 983 | if (st->state == MSG_FLOW_UNINITED) |
8723588e MC |
984 | return 0; |
985 | ||
555cbb32 | 986 | if (!s->s3.in_read_app_data || (s->s3.total_renegotiations == 0)) |
94836de2 | 987 | return 0; |
8723588e | 988 | |
94836de2 MC |
989 | if (s->server) { |
990 | /* | |
991 | * If we're a server and we haven't got as far as writing our | |
992 | * ServerHello yet then we allow app data | |
993 | */ | |
994 | if (st->hand_state == TLS_ST_BEFORE | |
a230b26e | 995 | || st->hand_state == TLS_ST_SR_CLNT_HELLO) |
94836de2 MC |
996 | return 1; |
997 | } else { | |
998 | /* | |
999 | * If we're a client and we haven't read the ServerHello yet then we | |
1000 | * allow app data | |
1001 | */ | |
1002 | if (st->hand_state == TLS_ST_CW_CLNT_HELLO) | |
8723588e | 1003 | return 1; |
8723588e MC |
1004 | } |
1005 | ||
8723588e MC |
1006 | return 0; |
1007 | } | |
1f5878b8 TT |
1008 | |
1009 | /* | |
1010 | * This function returns 1 if TLS exporter is ready to export keying | |
1011 | * material, or 0 if otherwise. | |
1012 | */ | |
38b051a1 | 1013 | int ossl_statem_export_allowed(SSL_CONNECTION *s) |
1f5878b8 | 1014 | { |
555cbb32 | 1015 | return s->s3.previous_server_finished_len != 0 |
1f5878b8 TT |
1016 | && s->statem.hand_state != TLS_ST_SW_FINISHED; |
1017 | } | |
b38ede80 TT |
1018 | |
1019 | /* | |
1020 | * Return 1 if early TLS exporter is ready to export keying material, | |
1021 | * or 0 if otherwise. | |
1022 | */ | |
38b051a1 | 1023 | int ossl_statem_export_early_allowed(SSL_CONNECTION *s) |
b38ede80 TT |
1024 | { |
1025 | /* | |
1026 | * The early exporter secret is only present on the server if we | |
1027 | * have accepted early_data. It is present on the client as long | |
1028 | * as we have sent early_data. | |
1029 | */ | |
1030 | return s->ext.early_data == SSL_EARLY_DATA_ACCEPTED | |
1031 | || (!s->server && s->ext.early_data != SSL_EARLY_DATA_NOT_SENT); | |
1032 | } |