]>
Commit | Line | Data |
---|---|---|
f8e0a557 | 1 | /* |
846e33c7 | 2 | * Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved. |
f8e0a557 | 3 | * |
846e33c7 RS |
4 | * Licensed under the OpenSSL license (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
f8e0a557 MC |
8 | */ |
9 | ||
10 | #include <openssl/rand.h> | |
8ba708e5 | 11 | #include "../ssl_locl.h" |
61ae935a | 12 | #include "statem_locl.h" |
f8e0a557 MC |
13 | |
14 | /* | |
15 | * This file implements the SSL/TLS/DTLS state machines. | |
16 | * | |
17 | * There are two primary state machines: | |
18 | * | |
19 | * 1) Message flow state machine | |
20 | * 2) Handshake state machine | |
21 | * | |
22 | * The Message flow state machine controls the reading and sending of messages | |
23 | * including handling of non-blocking IO events, flushing of the underlying | |
24 | * write BIO, handling unexpected messages, etc. It is itself broken into two | |
25 | * separate sub-state machines which control reading and writing respectively. | |
26 | * | |
27 | * The Handshake state machine keeps track of the current SSL/TLS handshake | |
28 | * state. Transitions of the handshake state are the result of events that | |
29 | * occur within the Message flow state machine. | |
30 | * | |
31 | * Overall it looks like this: | |
32 | * | |
33 | * --------------------------------------------- ------------------- | |
34 | * | | | | | |
35 | * | Message flow state machine | | | | |
36 | * | | | | | |
37 | * | -------------------- -------------------- | Transition | Handshake state | | |
61ae935a | 38 | * | | MSG_FLOW_READING | | MSG_FLOW_WRITING | | Event | machine | |
f8e0a557 MC |
39 | * | | sub-state | | sub-state | |----------->| | |
40 | * | | machine for | | machine for | | | | | |
41 | * | | reading messages | | writing messages | | | | | |
42 | * | -------------------- -------------------- | | | | |
43 | * | | | | | |
44 | * --------------------------------------------- ------------------- | |
45 | * | |
46 | */ | |
47 | ||
48 | /* Sub state machine return values */ | |
a230b26e | 49 | typedef enum { |
f8e0a557 MC |
50 | /* Something bad happened or NBIO */ |
51 | SUB_STATE_ERROR, | |
52 | /* Sub state finished go to the next sub state */ | |
53 | SUB_STATE_FINISHED, | |
54 | /* Sub state finished and handshake was completed */ | |
55 | SUB_STATE_END_HANDSHAKE | |
d78052cf | 56 | } SUB_STATE_RETURN; |
f8e0a557 | 57 | |
8723588e | 58 | static int state_machine(SSL *s, int server); |
f8e0a557 | 59 | static void init_read_state_machine(SSL *s); |
d78052cf | 60 | static SUB_STATE_RETURN read_state_machine(SSL *s); |
f8e0a557 | 61 | static void init_write_state_machine(SSL *s); |
d78052cf | 62 | static SUB_STATE_RETURN write_state_machine(SSL *s); |
49ae7423 | 63 | |
5998e290 | 64 | OSSL_HANDSHAKE_STATE SSL_get_state(const SSL *ssl) |
49ae7423 MC |
65 | { |
66 | return ssl->statem.hand_state; | |
67 | } | |
68 | ||
49ae7423 MC |
69 | int SSL_in_init(SSL *s) |
70 | { | |
71 | return s->statem.in_init; | |
72 | } | |
73 | ||
74 | int SSL_is_init_finished(SSL *s) | |
75 | { | |
76 | return !(s->statem.in_init) && (s->statem.hand_state == TLS_ST_OK); | |
77 | } | |
78 | ||
79 | int SSL_in_before(SSL *s) | |
80 | { | |
81 | /* | |
82 | * Historically being "in before" meant before anything had happened. In the | |
83 | * current code though we remain in the "before" state for a while after we | |
84 | * have started the handshake process (e.g. as a server waiting for the | |
85 | * first message to arrive). There "in before" is taken to mean "in before" | |
86 | * and not started any handshake process yet. | |
87 | */ | |
88 | return (s->statem.hand_state == TLS_ST_BEFORE) | |
89 | && (s->statem.state == MSG_FLOW_UNINITED); | |
90 | } | |
91 | ||
f8e0a557 MC |
92 | /* |
93 | * Clear the state machine state and reset back to MSG_FLOW_UNINITED | |
94 | */ | |
fe3a3291 | 95 | void ossl_statem_clear(SSL *s) |
f8e0a557 MC |
96 | { |
97 | s->statem.state = MSG_FLOW_UNINITED; | |
49ae7423 MC |
98 | s->statem.hand_state = TLS_ST_BEFORE; |
99 | s->statem.in_init = 1; | |
a71a4966 | 100 | s->statem.no_cert_verify = 0; |
f8e0a557 MC |
101 | } |
102 | ||
103 | /* | |
104 | * Set the state machine up ready for a renegotiation handshake | |
105 | */ | |
fe3a3291 | 106 | void ossl_statem_set_renegotiate(SSL *s) |
f8e0a557 MC |
107 | { |
108 | s->statem.state = MSG_FLOW_RENEGOTIATE; | |
c64359db | 109 | s->statem.in_init = 1; |
f8e0a557 MC |
110 | } |
111 | ||
112 | /* | |
113 | * Put the state machine into an error state. This is a permanent error for | |
114 | * the current connection. | |
115 | */ | |
fe3a3291 | 116 | void ossl_statem_set_error(SSL *s) |
f8e0a557 MC |
117 | { |
118 | s->statem.state = MSG_FLOW_ERROR; | |
49ae7423 MC |
119 | } |
120 | ||
121 | /* | |
122 | * Discover whether the current connection is in the error state. | |
123 | * | |
124 | * Valid return values are: | |
125 | * 1: Yes | |
126 | * 0: No | |
127 | */ | |
fe3a3291 | 128 | int ossl_statem_in_error(const SSL *s) |
49ae7423 MC |
129 | { |
130 | if (s->statem.state == MSG_FLOW_ERROR) | |
131 | return 1; | |
132 | ||
133 | return 0; | |
134 | } | |
135 | ||
fe3a3291 | 136 | void ossl_statem_set_in_init(SSL *s, int init) |
49ae7423 MC |
137 | { |
138 | s->statem.in_init = init; | |
f8e0a557 MC |
139 | } |
140 | ||
024f543c MC |
141 | int ossl_statem_get_in_handshake(SSL *s) |
142 | { | |
143 | return s->statem.in_handshake; | |
144 | } | |
145 | ||
146 | void ossl_statem_set_in_handshake(SSL *s, int inhand) | |
147 | { | |
148 | if (inhand) | |
149 | s->statem.in_handshake++; | |
150 | else | |
151 | s->statem.in_handshake--; | |
152 | } | |
153 | ||
31fd10e6 MC |
154 | void ossl_statem_set_hello_verify_done(SSL *s) |
155 | { | |
156 | s->statem.state = MSG_FLOW_UNINITED; | |
157 | s->statem.in_init = 1; | |
158 | /* | |
159 | * This will get reset (briefly) back to TLS_ST_BEFORE when we enter | |
160 | * state_machine() because |state| is MSG_FLOW_UNINITED, but until then any | |
161 | * calls to SSL_in_before() will return false. Also calls to | |
162 | * SSL_state_string() and SSL_state_string_long() will return something | |
163 | * sensible. | |
164 | */ | |
165 | s->statem.hand_state = TLS_ST_SR_CLNT_HELLO; | |
166 | } | |
167 | ||
a230b26e EK |
168 | int ossl_statem_connect(SSL *s) |
169 | { | |
8723588e MC |
170 | return state_machine(s, 0); |
171 | } | |
172 | ||
fe3a3291 | 173 | int ossl_statem_accept(SSL *s) |
c130dd8e MC |
174 | { |
175 | return state_machine(s, 1); | |
176 | } | |
177 | ||
a230b26e EK |
178 | typedef void (*info_cb) (const SSL *, int, int); |
179 | ||
180 | static info_cb get_callback(SSL *s) | |
91eac8d5 MC |
181 | { |
182 | if (s->info_callback != NULL) | |
183 | return s->info_callback; | |
184 | else if (s->ctx->info_callback != NULL) | |
185 | return s->ctx->info_callback; | |
186 | ||
187 | return NULL; | |
188 | } | |
189 | ||
f8e0a557 MC |
190 | /* |
191 | * The main message flow state machine. We start in the MSG_FLOW_UNINITED or | |
192 | * MSG_FLOW_RENEGOTIATE state and finish in MSG_FLOW_FINISHED. Valid states and | |
193 | * transitions are as follows: | |
194 | * | |
195 | * MSG_FLOW_UNINITED MSG_FLOW_RENEGOTIATE | |
196 | * | | | |
197 | * +-----------------------+ | |
198 | * v | |
199 | * MSG_FLOW_WRITING <---> MSG_FLOW_READING | |
200 | * | | |
201 | * V | |
202 | * MSG_FLOW_FINISHED | |
203 | * | | |
204 | * V | |
205 | * [SUCCESS] | |
206 | * | |
207 | * We may exit at any point due to an error or NBIO event. If an NBIO event | |
208 | * occurs then we restart at the point we left off when we are recalled. | |
209 | * MSG_FLOW_WRITING and MSG_FLOW_READING have sub-state machines associated with them. | |
210 | * | |
211 | * In addition to the above there is also the MSG_FLOW_ERROR state. We can move | |
212 | * into that state at any point in the event that an irrecoverable error occurs. | |
213 | * | |
214 | * Valid return values are: | |
215 | * 1: Success | |
216 | * <=0: NBIO or error | |
217 | */ | |
4fa52141 VD |
218 | static int state_machine(SSL *s, int server) |
219 | { | |
f8e0a557 MC |
220 | BUF_MEM *buf = NULL; |
221 | unsigned long Time = (unsigned long)time(NULL); | |
222 | void (*cb) (const SSL *ssl, int type, int val) = NULL; | |
d6f1a6e9 | 223 | OSSL_STATEM *st = &s->statem; |
f8e0a557 MC |
224 | int ret = -1; |
225 | int ssret; | |
226 | ||
227 | if (st->state == MSG_FLOW_ERROR) { | |
228 | /* Shouldn't have been called if we're already in the error state */ | |
229 | return -1; | |
230 | } | |
231 | ||
232 | RAND_add(&Time, sizeof(Time), 0); | |
233 | ERR_clear_error(); | |
234 | clear_sys_error(); | |
235 | ||
91eac8d5 | 236 | cb = get_callback(s); |
f8e0a557 | 237 | |
024f543c | 238 | st->in_handshake++; |
f8e0a557 MC |
239 | if (!SSL_in_init(s) || SSL_in_before(s)) { |
240 | if (!SSL_clear(s)) | |
241 | return -1; | |
242 | } | |
473483d4 MC |
243 | #ifndef OPENSSL_NO_SCTP |
244 | if (SSL_IS_DTLS(s)) { | |
245 | /* | |
246 | * Notify SCTP BIO socket to enter handshake mode and prevent stream | |
247 | * identifier other than 0. Will be ignored if no SCTP is used. | |
248 | */ | |
249 | BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE, | |
024f543c | 250 | st->in_handshake, NULL); |
473483d4 MC |
251 | } |
252 | #endif | |
253 | ||
f8e0a557 MC |
254 | #ifndef OPENSSL_NO_HEARTBEATS |
255 | /* | |
256 | * If we're awaiting a HeartbeatResponse, pretend we already got and | |
257 | * don't await it anymore, because Heartbeats don't make sense during | |
258 | * handshakes anyway. | |
259 | */ | |
260 | if (s->tlsext_hb_pending) { | |
261 | if (SSL_IS_DTLS(s)) | |
262 | dtls1_stop_timer(s); | |
263 | s->tlsext_hb_pending = 0; | |
264 | s->tlsext_hb_seq++; | |
265 | } | |
266 | #endif | |
267 | ||
268 | /* Initialise state machine */ | |
269 | ||
270 | if (st->state == MSG_FLOW_RENEGOTIATE) { | |
271 | s->renegotiate = 1; | |
272 | if (!server) | |
273 | s->ctx->stats.sess_connect_renegotiate++; | |
274 | } | |
275 | ||
276 | if (st->state == MSG_FLOW_UNINITED || st->state == MSG_FLOW_RENEGOTIATE) { | |
f8e0a557 MC |
277 | if (st->state == MSG_FLOW_UNINITED) { |
278 | st->hand_state = TLS_ST_BEFORE; | |
279 | } | |
280 | ||
281 | s->server = server; | |
282 | if (cb != NULL) | |
283 | cb(s, SSL_CB_HANDSHAKE_START, 1); | |
284 | ||
285 | if (SSL_IS_DTLS(s)) { | |
286 | if ((s->version & 0xff00) != (DTLS1_VERSION & 0xff00) && | |
a230b26e | 287 | (server || (s->version & 0xff00) != (DTLS1_BAD_VER & 0xff00))) { |
f8e0a557 MC |
288 | SSLerr(SSL_F_STATE_MACHINE, ERR_R_INTERNAL_ERROR); |
289 | goto end; | |
290 | } | |
291 | } else { | |
4fa52141 | 292 | if ((s->version >> 8) != SSL3_VERSION_MAJOR) { |
f8e0a557 MC |
293 | SSLerr(SSL_F_STATE_MACHINE, ERR_R_INTERNAL_ERROR); |
294 | goto end; | |
295 | } | |
296 | } | |
297 | ||
4fa52141 VD |
298 | if (!ssl_security(s, SSL_SECOP_VERSION, 0, s->version, NULL)) { |
299 | SSLerr(SSL_F_STATE_MACHINE, SSL_R_VERSION_TOO_LOW); | |
300 | goto end; | |
f8e0a557 MC |
301 | } |
302 | ||
f8e0a557 MC |
303 | if (s->init_buf == NULL) { |
304 | if ((buf = BUF_MEM_new()) == NULL) { | |
305 | goto end; | |
306 | } | |
307 | if (!BUF_MEM_grow(buf, SSL3_RT_MAX_PLAIN_LENGTH)) { | |
308 | goto end; | |
309 | } | |
310 | s->init_buf = buf; | |
311 | buf = NULL; | |
312 | } | |
313 | ||
314 | if (!ssl3_setup_buffers(s)) { | |
315 | goto end; | |
316 | } | |
317 | s->init_num = 0; | |
318 | ||
319 | /* | |
320 | * Should have been reset by tls_process_finished, too. | |
321 | */ | |
322 | s->s3->change_cipher_spec = 0; | |
323 | ||
46417569 MC |
324 | /* |
325 | * Ok, we now need to push on a buffering BIO ...but not with | |
326 | * SCTP | |
327 | */ | |
f8e0a557 | 328 | #ifndef OPENSSL_NO_SCTP |
46417569 | 329 | if (!SSL_IS_DTLS(s) || !BIO_dgram_is_sctp(SSL_get_wbio(s))) |
f8e0a557 | 330 | #endif |
46417569 MC |
331 | if (!ssl_init_wbio_buffer(s)) { |
332 | goto end; | |
333 | } | |
f8e0a557 | 334 | |
2c4a056f MC |
335 | if (!server || st->state != MSG_FLOW_RENEGOTIATE) { |
336 | if (!ssl3_init_finished_mac(s)) { | |
337 | ossl_statem_set_error(s); | |
338 | goto end; | |
339 | } | |
340 | } | |
f8e0a557 MC |
341 | |
342 | if (server) { | |
343 | if (st->state != MSG_FLOW_RENEGOTIATE) { | |
344 | s->ctx->stats.sess_accept++; | |
345 | } else if (!s->s3->send_connection_binding && | |
346 | !(s->options & | |
347 | SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) { | |
348 | /* | |
349 | * Server attempting to renegotiate with client that doesn't | |
350 | * support secure renegotiation. | |
351 | */ | |
352 | SSLerr(SSL_F_STATE_MACHINE, | |
353 | SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED); | |
354 | ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE); | |
fe3a3291 | 355 | ossl_statem_set_error(s); |
f8e0a557 MC |
356 | goto end; |
357 | } else { | |
358 | /* | |
e0a51488 | 359 | * st->state == MSG_FLOW_RENEGOTIATE, we will just send a |
f8e0a557 MC |
360 | * HelloRequest |
361 | */ | |
362 | s->ctx->stats.sess_accept_renegotiate++; | |
363 | } | |
364 | } else { | |
365 | s->ctx->stats.sess_connect++; | |
366 | ||
367 | /* mark client_random uninitialized */ | |
368 | memset(s->s3->client_random, 0, sizeof(s->s3->client_random)); | |
369 | s->hit = 0; | |
370 | ||
371 | s->s3->tmp.cert_request = 0; | |
372 | ||
373 | if (SSL_IS_DTLS(s)) { | |
374 | st->use_timer = 1; | |
375 | } | |
376 | } | |
377 | ||
378 | st->state = MSG_FLOW_WRITING; | |
379 | init_write_state_machine(s); | |
380 | st->read_state_first_init = 1; | |
381 | } | |
382 | ||
e8aa8b6c F |
383 | while (st->state != MSG_FLOW_FINISHED) { |
384 | if (st->state == MSG_FLOW_READING) { | |
f8e0a557 MC |
385 | ssret = read_state_machine(s); |
386 | if (ssret == SUB_STATE_FINISHED) { | |
387 | st->state = MSG_FLOW_WRITING; | |
388 | init_write_state_machine(s); | |
389 | } else { | |
390 | /* NBIO or error */ | |
391 | goto end; | |
392 | } | |
393 | } else if (st->state == MSG_FLOW_WRITING) { | |
394 | ssret = write_state_machine(s); | |
395 | if (ssret == SUB_STATE_FINISHED) { | |
396 | st->state = MSG_FLOW_READING; | |
397 | init_read_state_machine(s); | |
398 | } else if (ssret == SUB_STATE_END_HANDSHAKE) { | |
399 | st->state = MSG_FLOW_FINISHED; | |
400 | } else { | |
401 | /* NBIO or error */ | |
402 | goto end; | |
403 | } | |
404 | } else { | |
405 | /* Error */ | |
fe3a3291 | 406 | ossl_statem_set_error(s); |
f8e0a557 MC |
407 | goto end; |
408 | } | |
409 | } | |
410 | ||
411 | st->state = MSG_FLOW_UNINITED; | |
412 | ret = 1; | |
413 | ||
414 | end: | |
024f543c | 415 | st->in_handshake--; |
473483d4 MC |
416 | |
417 | #ifndef OPENSSL_NO_SCTP | |
418 | if (SSL_IS_DTLS(s)) { | |
419 | /* | |
420 | * Notify SCTP BIO socket to leave handshake mode and allow stream | |
421 | * identifier other than 0. Will be ignored if no SCTP is used. | |
422 | */ | |
423 | BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE, | |
024f543c | 424 | st->in_handshake, NULL); |
473483d4 MC |
425 | } |
426 | #endif | |
427 | ||
f8e0a557 MC |
428 | BUF_MEM_free(buf); |
429 | if (cb != NULL) { | |
430 | if (server) | |
431 | cb(s, SSL_CB_ACCEPT_EXIT, ret); | |
432 | else | |
433 | cb(s, SSL_CB_CONNECT_EXIT, ret); | |
434 | } | |
435 | return ret; | |
436 | } | |
437 | ||
438 | /* | |
439 | * Initialise the MSG_FLOW_READING sub-state machine | |
440 | */ | |
441 | static void init_read_state_machine(SSL *s) | |
442 | { | |
d6f1a6e9 | 443 | OSSL_STATEM *st = &s->statem; |
f8e0a557 MC |
444 | |
445 | st->read_state = READ_STATE_HEADER; | |
446 | } | |
447 | ||
0d698f66 MC |
448 | static int grow_init_buf(SSL *s, size_t size) { |
449 | ||
450 | size_t msg_offset = (char *)s->init_msg - s->init_buf->data; | |
451 | ||
452 | if (!BUF_MEM_grow_clean(s->init_buf, (int)size)) | |
453 | return 0; | |
454 | ||
455 | if (size < msg_offset) | |
456 | return 0; | |
457 | ||
458 | s->init_msg = s->init_buf->data + msg_offset; | |
459 | ||
460 | return 1; | |
461 | } | |
462 | ||
f8e0a557 MC |
463 | /* |
464 | * This function implements the sub-state machine when the message flow is in | |
465 | * MSG_FLOW_READING. The valid sub-states and transitions are: | |
466 | * | |
467 | * READ_STATE_HEADER <--+<-------------+ | |
468 | * | | | | |
469 | * v | | | |
470 | * READ_STATE_BODY -----+-->READ_STATE_POST_PROCESS | |
471 | * | | | |
472 | * +----------------------------+ | |
473 | * v | |
474 | * [SUB_STATE_FINISHED] | |
475 | * | |
476 | * READ_STATE_HEADER has the responsibility for reading in the message header | |
477 | * and transitioning the state of the handshake state machine. | |
478 | * | |
479 | * READ_STATE_BODY reads in the rest of the message and then subsequently | |
480 | * processes it. | |
481 | * | |
482 | * READ_STATE_POST_PROCESS is an optional step that may occur if some post | |
483 | * processing activity performed on the message may block. | |
484 | * | |
0d4fb843 | 485 | * Any of the above states could result in an NBIO event occurring in which case |
f8e0a557 MC |
486 | * control returns to the calling application. When this function is recalled we |
487 | * will resume in the same state where we left off. | |
488 | */ | |
a230b26e EK |
489 | static SUB_STATE_RETURN read_state_machine(SSL *s) |
490 | { | |
d6f1a6e9 | 491 | OSSL_STATEM *st = &s->statem; |
f8e0a557 | 492 | int ret, mt; |
eda75751 | 493 | size_t len = 0; |
a230b26e | 494 | int (*transition) (SSL *s, int mt); |
73999b62 | 495 | PACKET pkt; |
a230b26e EK |
496 | MSG_PROCESS_RETURN(*process_message) (SSL *s, PACKET *pkt); |
497 | WORK_STATE(*post_process_message) (SSL *s, WORK_STATE wst); | |
eda75751 | 498 | size_t (*max_message_size) (SSL *s); |
f8e0a557 MC |
499 | void (*cb) (const SSL *ssl, int type, int val) = NULL; |
500 | ||
91eac8d5 | 501 | cb = get_callback(s); |
f8e0a557 | 502 | |
e8aa8b6c | 503 | if (s->server) { |
8481f583 MC |
504 | transition = ossl_statem_server_read_transition; |
505 | process_message = ossl_statem_server_process_message; | |
506 | max_message_size = ossl_statem_server_max_message_size; | |
507 | post_process_message = ossl_statem_server_post_process_message; | |
f8e0a557 | 508 | } else { |
8481f583 MC |
509 | transition = ossl_statem_client_read_transition; |
510 | process_message = ossl_statem_client_process_message; | |
511 | max_message_size = ossl_statem_client_max_message_size; | |
512 | post_process_message = ossl_statem_client_post_process_message; | |
f8e0a557 MC |
513 | } |
514 | ||
515 | if (st->read_state_first_init) { | |
516 | s->first_packet = 1; | |
517 | st->read_state_first_init = 0; | |
518 | } | |
519 | ||
e8aa8b6c F |
520 | while (1) { |
521 | switch (st->read_state) { | |
f8e0a557 | 522 | case READ_STATE_HEADER: |
f8e0a557 | 523 | /* Get the state the peer wants to move to */ |
76af3037 MC |
524 | if (SSL_IS_DTLS(s)) { |
525 | /* | |
526 | * In DTLS we get the whole message in one go - header and body | |
527 | */ | |
528 | ret = dtls_get_message(s, &mt, &len); | |
529 | } else { | |
530 | ret = tls_get_message_header(s, &mt); | |
531 | } | |
f8e0a557 MC |
532 | |
533 | if (ret == 0) { | |
534 | /* Could be non-blocking IO */ | |
535 | return SUB_STATE_ERROR; | |
536 | } | |
537 | ||
538 | if (cb != NULL) { | |
539 | /* Notify callback of an impending state change */ | |
540 | if (s->server) | |
541 | cb(s, SSL_CB_ACCEPT_LOOP, 1); | |
542 | else | |
543 | cb(s, SSL_CB_CONNECT_LOOP, 1); | |
544 | } | |
545 | /* | |
546 | * Validate that we are allowed to move to the new state and move | |
547 | * to that state if so | |
548 | */ | |
e8aa8b6c | 549 | if (!transition(s, mt)) { |
672f3337 | 550 | ossl_statem_set_error(s); |
f8e0a557 MC |
551 | return SUB_STATE_ERROR; |
552 | } | |
553 | ||
554 | if (s->s3->tmp.message_size > max_message_size(s)) { | |
555 | ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); | |
556 | SSLerr(SSL_F_READ_STATE_MACHINE, SSL_R_EXCESSIVE_MESSAGE_SIZE); | |
557 | return SUB_STATE_ERROR; | |
558 | } | |
559 | ||
c1ef7c97 MC |
560 | /* dtls_get_message already did this */ |
561 | if (!SSL_IS_DTLS(s) | |
562 | && s->s3->tmp.message_size > 0 | |
0d698f66 MC |
563 | && !grow_init_buf(s, s->s3->tmp.message_size |
564 | + SSL3_HM_HEADER_LENGTH)) { | |
c1ef7c97 | 565 | ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); |
a449b47c | 566 | SSLerr(SSL_F_READ_STATE_MACHINE, ERR_R_BUF_LIB); |
c1ef7c97 MC |
567 | return SUB_STATE_ERROR; |
568 | } | |
569 | ||
f8e0a557 MC |
570 | st->read_state = READ_STATE_BODY; |
571 | /* Fall through */ | |
572 | ||
573 | case READ_STATE_BODY: | |
574 | if (!SSL_IS_DTLS(s)) { | |
575 | /* We already got this above for DTLS */ | |
576 | ret = tls_get_message_body(s, &len); | |
577 | if (ret == 0) { | |
578 | /* Could be non-blocking IO */ | |
579 | return SUB_STATE_ERROR; | |
580 | } | |
581 | } | |
582 | ||
583 | s->first_packet = 0; | |
73999b62 MC |
584 | if (!PACKET_buf_init(&pkt, s->init_msg, len)) { |
585 | ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); | |
586 | SSLerr(SSL_F_READ_STATE_MACHINE, ERR_R_INTERNAL_ERROR); | |
587 | return SUB_STATE_ERROR; | |
588 | } | |
589 | ret = process_message(s, &pkt); | |
1689e7e6 MC |
590 | |
591 | /* Discard the packet data */ | |
592 | s->init_num = 0; | |
593 | ||
4f8a5f4d AG |
594 | switch (ret) { |
595 | case MSG_PROCESS_ERROR: | |
f8e0a557 | 596 | return SUB_STATE_ERROR; |
f8e0a557 | 597 | |
4f8a5f4d | 598 | case MSG_PROCESS_FINISHED_READING: |
f8e0a557 MC |
599 | if (SSL_IS_DTLS(s)) { |
600 | dtls1_stop_timer(s); | |
601 | } | |
602 | return SUB_STATE_FINISHED; | |
f8e0a557 | 603 | |
4f8a5f4d | 604 | case MSG_PROCESS_CONTINUE_PROCESSING: |
f8e0a557 MC |
605 | st->read_state = READ_STATE_POST_PROCESS; |
606 | st->read_state_work = WORK_MORE_A; | |
4f8a5f4d AG |
607 | break; |
608 | ||
609 | default: | |
f8e0a557 | 610 | st->read_state = READ_STATE_HEADER; |
4f8a5f4d | 611 | break; |
f8e0a557 MC |
612 | } |
613 | break; | |
614 | ||
615 | case READ_STATE_POST_PROCESS: | |
616 | st->read_state_work = post_process_message(s, st->read_state_work); | |
e8aa8b6c | 617 | switch (st->read_state_work) { |
f3b3d7f0 RS |
618 | case WORK_ERROR: |
619 | case WORK_MORE_A: | |
620 | case WORK_MORE_B: | |
f8e0a557 MC |
621 | return SUB_STATE_ERROR; |
622 | ||
623 | case WORK_FINISHED_CONTINUE: | |
624 | st->read_state = READ_STATE_HEADER; | |
625 | break; | |
626 | ||
627 | case WORK_FINISHED_STOP: | |
628 | if (SSL_IS_DTLS(s)) { | |
629 | dtls1_stop_timer(s); | |
630 | } | |
631 | return SUB_STATE_FINISHED; | |
632 | } | |
633 | break; | |
634 | ||
635 | default: | |
636 | /* Shouldn't happen */ | |
637 | ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); | |
638 | SSLerr(SSL_F_READ_STATE_MACHINE, ERR_R_INTERNAL_ERROR); | |
fe3a3291 | 639 | ossl_statem_set_error(s); |
f8e0a557 MC |
640 | return SUB_STATE_ERROR; |
641 | } | |
642 | } | |
643 | } | |
644 | ||
645 | /* | |
646 | * Send a previously constructed message to the peer. | |
647 | */ | |
648 | static int statem_do_write(SSL *s) | |
649 | { | |
d6f1a6e9 | 650 | OSSL_STATEM *st = &s->statem; |
f8e0a557 MC |
651 | |
652 | if (st->hand_state == TLS_ST_CW_CHANGE | |
a230b26e | 653 | || st->hand_state == TLS_ST_SW_CHANGE) { |
f8e0a557 MC |
654 | if (SSL_IS_DTLS(s)) |
655 | return dtls1_do_write(s, SSL3_RT_CHANGE_CIPHER_SPEC); | |
656 | else | |
657 | return ssl3_do_write(s, SSL3_RT_CHANGE_CIPHER_SPEC); | |
658 | } else { | |
659 | return ssl_do_write(s); | |
660 | } | |
661 | } | |
662 | ||
663 | /* | |
664 | * Initialise the MSG_FLOW_WRITING sub-state machine | |
665 | */ | |
666 | static void init_write_state_machine(SSL *s) | |
667 | { | |
d6f1a6e9 | 668 | OSSL_STATEM *st = &s->statem; |
f8e0a557 MC |
669 | |
670 | st->write_state = WRITE_STATE_TRANSITION; | |
671 | } | |
672 | ||
673 | /* | |
674 | * This function implements the sub-state machine when the message flow is in | |
675 | * MSG_FLOW_WRITING. The valid sub-states and transitions are: | |
676 | * | |
677 | * +-> WRITE_STATE_TRANSITION ------> [SUB_STATE_FINISHED] | |
678 | * | | | |
679 | * | v | |
680 | * | WRITE_STATE_PRE_WORK -----> [SUB_STATE_END_HANDSHAKE] | |
681 | * | | | |
682 | * | v | |
683 | * | WRITE_STATE_SEND | |
684 | * | | | |
685 | * | v | |
686 | * | WRITE_STATE_POST_WORK | |
687 | * | | | |
688 | * +-------------+ | |
689 | * | |
690 | * WRITE_STATE_TRANSITION transitions the state of the handshake state machine | |
691 | ||
692 | * WRITE_STATE_PRE_WORK performs any work necessary to prepare the later | |
0d4fb843 | 693 | * sending of the message. This could result in an NBIO event occurring in |
f8e0a557 MC |
694 | * which case control returns to the calling application. When this function |
695 | * is recalled we will resume in the same state where we left off. | |
696 | * | |
697 | * WRITE_STATE_SEND sends the message and performs any work to be done after | |
698 | * sending. | |
699 | * | |
700 | * WRITE_STATE_POST_WORK performs any work necessary after the sending of the | |
701 | * message has been completed. As for WRITE_STATE_PRE_WORK this could also | |
702 | * result in an NBIO event. | |
703 | */ | |
d78052cf | 704 | static SUB_STATE_RETURN write_state_machine(SSL *s) |
f8e0a557 | 705 | { |
d6f1a6e9 | 706 | OSSL_STATEM *st = &s->statem; |
f8e0a557 | 707 | int ret; |
a230b26e EK |
708 | WRITE_TRAN(*transition) (SSL *s); |
709 | WORK_STATE(*pre_work) (SSL *s, WORK_STATE wst); | |
710 | WORK_STATE(*post_work) (SSL *s, WORK_STATE wst); | |
6392fb8e MC |
711 | int (*get_construct_message_f) (SSL *s, WPACKET *pkt, |
712 | int (**confunc) (SSL *s, WPACKET *pkt), | |
713 | int *mt); | |
f8e0a557 | 714 | void (*cb) (const SSL *ssl, int type, int val) = NULL; |
6392fb8e MC |
715 | int (*confunc) (SSL *s, WPACKET *pkt); |
716 | int mt; | |
7cea05dc | 717 | WPACKET pkt; |
f8e0a557 | 718 | |
91eac8d5 | 719 | cb = get_callback(s); |
f8e0a557 | 720 | |
e8aa8b6c | 721 | if (s->server) { |
8481f583 MC |
722 | transition = ossl_statem_server_write_transition; |
723 | pre_work = ossl_statem_server_pre_work; | |
724 | post_work = ossl_statem_server_post_work; | |
6392fb8e | 725 | get_construct_message_f = ossl_statem_server_construct_message; |
f8e0a557 | 726 | } else { |
8481f583 MC |
727 | transition = ossl_statem_client_write_transition; |
728 | pre_work = ossl_statem_client_pre_work; | |
729 | post_work = ossl_statem_client_post_work; | |
6392fb8e | 730 | get_construct_message_f = ossl_statem_client_construct_message; |
f8e0a557 MC |
731 | } |
732 | ||
e8aa8b6c F |
733 | while (1) { |
734 | switch (st->write_state) { | |
f8e0a557 MC |
735 | case WRITE_STATE_TRANSITION: |
736 | if (cb != NULL) { | |
737 | /* Notify callback of an impending state change */ | |
738 | if (s->server) | |
739 | cb(s, SSL_CB_ACCEPT_LOOP, 1); | |
740 | else | |
741 | cb(s, SSL_CB_CONNECT_LOOP, 1); | |
742 | } | |
e8aa8b6c | 743 | switch (transition(s)) { |
f8e0a557 MC |
744 | case WRITE_TRAN_CONTINUE: |
745 | st->write_state = WRITE_STATE_PRE_WORK; | |
746 | st->write_state_work = WORK_MORE_A; | |
747 | break; | |
748 | ||
749 | case WRITE_TRAN_FINISHED: | |
750 | return SUB_STATE_FINISHED; | |
751 | break; | |
752 | ||
f3b3d7f0 | 753 | case WRITE_TRAN_ERROR: |
f8e0a557 MC |
754 | return SUB_STATE_ERROR; |
755 | } | |
756 | break; | |
757 | ||
758 | case WRITE_STATE_PRE_WORK: | |
e8aa8b6c | 759 | switch (st->write_state_work = pre_work(s, st->write_state_work)) { |
f3b3d7f0 RS |
760 | case WORK_ERROR: |
761 | case WORK_MORE_A: | |
762 | case WORK_MORE_B: | |
f8e0a557 MC |
763 | return SUB_STATE_ERROR; |
764 | ||
765 | case WORK_FINISHED_CONTINUE: | |
766 | st->write_state = WRITE_STATE_SEND; | |
767 | break; | |
768 | ||
769 | case WORK_FINISHED_STOP: | |
770 | return SUB_STATE_END_HANDSHAKE; | |
771 | } | |
7cea05dc | 772 | if (!WPACKET_init(&pkt, s->init_buf) |
6392fb8e MC |
773 | || !get_construct_message_f(s, &pkt, &confunc, &mt) |
774 | || !ssl_set_handshake_header(s, &pkt, mt) | |
775 | || (confunc != NULL && !confunc(s, &pkt)) | |
776 | || !ssl_close_construct_packet(s, &pkt, mt) | |
7cea05dc MC |
777 | || !WPACKET_finish(&pkt)) { |
778 | WPACKET_cleanup(&pkt); | |
779 | ossl_statem_set_error(s); | |
f8e0a557 | 780 | return SUB_STATE_ERROR; |
7cea05dc | 781 | } |
f8e0a557 MC |
782 | |
783 | /* Fall through */ | |
784 | ||
785 | case WRITE_STATE_SEND: | |
786 | if (SSL_IS_DTLS(s) && st->use_timer) { | |
787 | dtls1_start_timer(s); | |
788 | } | |
789 | ret = statem_do_write(s); | |
790 | if (ret <= 0) { | |
791 | return SUB_STATE_ERROR; | |
792 | } | |
793 | st->write_state = WRITE_STATE_POST_WORK; | |
794 | st->write_state_work = WORK_MORE_A; | |
795 | /* Fall through */ | |
796 | ||
797 | case WRITE_STATE_POST_WORK: | |
e8aa8b6c | 798 | switch (st->write_state_work = post_work(s, st->write_state_work)) { |
f3b3d7f0 RS |
799 | case WORK_ERROR: |
800 | case WORK_MORE_A: | |
801 | case WORK_MORE_B: | |
f8e0a557 MC |
802 | return SUB_STATE_ERROR; |
803 | ||
804 | case WORK_FINISHED_CONTINUE: | |
805 | st->write_state = WRITE_STATE_TRANSITION; | |
806 | break; | |
807 | ||
808 | case WORK_FINISHED_STOP: | |
809 | return SUB_STATE_END_HANDSHAKE; | |
810 | } | |
811 | break; | |
812 | ||
813 | default: | |
814 | return SUB_STATE_ERROR; | |
815 | } | |
816 | } | |
817 | } | |
818 | ||
8723588e MC |
819 | /* |
820 | * Flush the write BIO | |
821 | */ | |
61ae935a | 822 | int statem_flush(SSL *s) |
8723588e MC |
823 | { |
824 | s->rwstate = SSL_WRITING; | |
825 | if (BIO_flush(s->wbio) <= 0) { | |
826 | return 0; | |
827 | } | |
828 | s->rwstate = SSL_NOTHING; | |
829 | ||
830 | return 1; | |
831 | } | |
832 | ||
f8e0a557 MC |
833 | /* |
834 | * Called by the record layer to determine whether application data is | |
835 | * allowed to be sent in the current handshake state or not. | |
836 | * | |
837 | * Return values are: | |
838 | * 1: Yes (application data allowed) | |
839 | * 0: No (application data not allowed) | |
840 | */ | |
fe3a3291 | 841 | int ossl_statem_app_data_allowed(SSL *s) |
f8e0a557 | 842 | { |
d6f1a6e9 | 843 | OSSL_STATEM *st = &s->statem; |
f8e0a557 | 844 | |
94836de2 | 845 | if (st->state == MSG_FLOW_UNINITED || st->state == MSG_FLOW_RENEGOTIATE) |
8723588e MC |
846 | return 0; |
847 | ||
94836de2 MC |
848 | if (!s->s3->in_read_app_data || (s->s3->total_renegotiations == 0)) |
849 | return 0; | |
8723588e | 850 | |
94836de2 MC |
851 | if (s->server) { |
852 | /* | |
853 | * If we're a server and we haven't got as far as writing our | |
854 | * ServerHello yet then we allow app data | |
855 | */ | |
856 | if (st->hand_state == TLS_ST_BEFORE | |
a230b26e | 857 | || st->hand_state == TLS_ST_SR_CLNT_HELLO) |
94836de2 MC |
858 | return 1; |
859 | } else { | |
860 | /* | |
861 | * If we're a client and we haven't read the ServerHello yet then we | |
862 | * allow app data | |
863 | */ | |
864 | if (st->hand_state == TLS_ST_CW_CLNT_HELLO) | |
8723588e | 865 | return 1; |
8723588e MC |
866 | } |
867 | ||
8723588e MC |
868 | return 0; |
869 | } | |
870 | ||
8723588e MC |
871 | #ifndef OPENSSL_NO_SCTP |
872 | /* | |
873 | * Set flag used by SCTP to determine whether we are in the read sock state | |
874 | */ | |
fe3a3291 | 875 | void ossl_statem_set_sctp_read_sock(SSL *s, int read_sock) |
8723588e MC |
876 | { |
877 | s->statem.in_sctp_read_sock = read_sock; | |
878 | } | |
879 | ||
880 | /* | |
881 | * Called by the record layer to determine whether we are in the read sock | |
882 | * state or not. | |
883 | * | |
884 | * Return values are: | |
885 | * 1: Yes (we are in the read sock state) | |
886 | * 0: No (we are not in the read sock state) | |
887 | */ | |
d99b0691 | 888 | int ossl_statem_in_sctp_read_sock(SSL *s) |
8723588e MC |
889 | { |
890 | return s->statem.in_sctp_read_sock; | |
891 | } | |
892 | #endif |