3 * DTLS implementation written by Nagendra Modadugu
4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
6 /* ====================================================================
7 * Copyright (c) 1999-2007 The OpenSSL Project. All rights reserved.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in
18 * the documentation and/or other materials provided with the
21 * 3. All advertising materials mentioning features or use of this
22 * software must display the following acknowledgment:
23 * "This product includes software developed by the OpenSSL Project
24 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
26 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
27 * endorse or promote products derived from this software without
28 * prior written permission. For written permission, please contact
29 * openssl-core@OpenSSL.org.
31 * 5. Products derived from this software may not be called "OpenSSL"
32 * nor may "OpenSSL" appear in their names without prior written
33 * permission of the OpenSSL Project.
35 * 6. Redistributions of any form whatsoever must retain the following
37 * "This product includes software developed by the OpenSSL Project
38 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
40 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
41 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
43 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
44 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
45 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
46 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
47 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
49 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
50 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
51 * OF THE POSSIBILITY OF SUCH DAMAGE.
52 * ====================================================================
54 * This product includes cryptographic software written by Eric Young
55 * (eay@cryptsoft.com). This product includes software written by Tim
56 * Hudson (tjh@cryptsoft.com).
59 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
60 * All rights reserved.
62 * This package is an SSL implementation written
63 * by Eric Young (eay@cryptsoft.com).
64 * The implementation was written so as to conform with Netscapes SSL.
66 * This library is free for commercial and non-commercial use as long as
67 * the following conditions are aheared to. The following conditions
68 * apply to all code found in this distribution, be it the RC4, RSA,
69 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
70 * included with this distribution is covered by the same copyright terms
71 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
73 * Copyright remains Eric Young's, and as such any Copyright notices in
74 * the code are not to be removed.
75 * If this package is used in a product, Eric Young should be given attribution
76 * as the author of the parts of the library used.
77 * This can be in the form of a textual message at program startup or
78 * in documentation (online or textual) provided with the package.
80 * Redistribution and use in source and binary forms, with or without
81 * modification, are permitted provided that the following conditions
83 * 1. Redistributions of source code must retain the copyright
84 * notice, this list of conditions and the following disclaimer.
85 * 2. Redistributions in binary form must reproduce the above copyright
86 * notice, this list of conditions and the following disclaimer in the
87 * documentation and/or other materials provided with the distribution.
88 * 3. All advertising materials mentioning features or use of this software
89 * must display the following acknowledgement:
90 * "This product includes cryptographic software written by
91 * Eric Young (eay@cryptsoft.com)"
92 * The word 'cryptographic' can be left out if the rouines from the library
93 * being used are not cryptographic related :-).
94 * 4. If you include any Windows specific code (or a derivative thereof) from
95 * the apps directory (application code) you must include an acknowledgement:
96 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
98 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
99 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
100 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
101 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
102 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
103 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
104 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
105 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
106 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
107 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
110 * The licence and distribution terms for any publically available version or
111 * derivative of this code cannot be changed. i.e. this code cannot simply be
112 * copied and put under another distribution licence
113 * [including the GNU Public Licence.]
117 #include "ssl_locl.h"
118 #ifndef OPENSSL_NO_KRB5
119 # include "kssl_lcl.h"
121 #include <openssl/buffer.h>
122 #include <openssl/rand.h>
123 #include <openssl/objects.h>
124 #include <openssl/evp.h>
125 #include <openssl/md5.h>
126 #include <openssl/bn.h>
127 #ifndef OPENSSL_NO_DH
128 # include <openssl/dh.h>
131 static const SSL_METHOD
*dtls1_get_client_method(int ver
);
132 static int dtls1_get_hello_verify(SSL
*s
);
134 static const SSL_METHOD
*dtls1_get_client_method(int ver
)
136 if (ver
== DTLS_ANY_VERSION
)
137 return DTLS_client_method();
138 else if (ver
== DTLS1_VERSION
|| ver
== DTLS1_BAD_VER
)
139 return DTLSv1_client_method();
140 else if (ver
== DTLS1_2_VERSION
)
141 return DTLSv1_2_client_method();
146 IMPLEMENT_dtls1_meth_func(DTLS1_VERSION
,
147 DTLSv1_client_method
,
148 ssl_undefined_function
,
150 dtls1_get_client_method
, DTLSv1_enc_data
)
152 IMPLEMENT_dtls1_meth_func(DTLS1_2_VERSION
,
153 DTLSv1_2_client_method
,
154 ssl_undefined_function
,
156 dtls1_get_client_method
, DTLSv1_2_enc_data
)
158 IMPLEMENT_dtls1_meth_func(DTLS_ANY_VERSION
,
160 ssl_undefined_function
,
162 dtls1_get_client_method
, DTLSv1_2_enc_data
)
164 int dtls1_connect(SSL
*s
)
167 unsigned long Time
= (unsigned long)time(NULL
);
168 void (*cb
) (const SSL
*ssl
, int type
, int val
) = NULL
;
170 int new_state
, state
, skip
= 0;
171 #ifndef OPENSSL_NO_SCTP
172 unsigned char sctpauthkey
[64];
173 char labelbuffer
[sizeof(DTLS1_SCTP_AUTH_LABEL
)];
176 RAND_add(&Time
, sizeof(Time
), 0);
180 if (s
->info_callback
!= NULL
)
181 cb
= s
->info_callback
;
182 else if (s
->ctx
->info_callback
!= NULL
)
183 cb
= s
->ctx
->info_callback
;
186 if (!SSL_in_init(s
) || SSL_in_before(s
))
189 #ifndef OPENSSL_NO_SCTP
191 * Notify SCTP BIO socket to enter handshake mode and prevent stream
192 * identifier other than 0. Will be ignored if no SCTP is used.
194 BIO_ctrl(SSL_get_wbio(s
), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE
,
195 s
->in_handshake
, NULL
);
198 #ifndef OPENSSL_NO_HEARTBEATS
200 * If we're awaiting a HeartbeatResponse, pretend we already got and
201 * don't await it anymore, because Heartbeats don't make sense during
204 if (s
->tlsext_hb_pending
) {
206 s
->tlsext_hb_pending
= 0;
215 case SSL_ST_RENEGOTIATE
:
217 s
->state
= SSL_ST_CONNECT
;
218 s
->ctx
->stats
.sess_connect_renegotiate
++;
222 case SSL_ST_BEFORE
| SSL_ST_CONNECT
:
223 case SSL_ST_OK
| SSL_ST_CONNECT
:
227 cb(s
, SSL_CB_HANDSHAKE_START
, 1);
229 if ((s
->version
& 0xff00) != (DTLS1_VERSION
& 0xff00) &&
230 (s
->version
& 0xff00) != (DTLS1_BAD_VER
& 0xff00)) {
231 SSLerr(SSL_F_DTLS1_CONNECT
, ERR_R_INTERNAL_ERROR
);
233 s
->state
= SSL_ST_ERR
;
237 /* s->version=SSL3_VERSION; */
238 s
->type
= SSL_ST_CONNECT
;
240 if (s
->init_buf
== NULL
) {
241 if ((buf
= BUF_MEM_new()) == NULL
) {
243 s
->state
= SSL_ST_ERR
;
246 if (!BUF_MEM_grow(buf
, SSL3_RT_MAX_PLAIN_LENGTH
)) {
248 s
->state
= SSL_ST_ERR
;
255 if (!ssl3_setup_buffers(s
)) {
257 s
->state
= SSL_ST_ERR
;
261 /* setup buffing BIO */
262 if (!ssl_init_wbio_buffer(s
, 0)) {
264 s
->state
= SSL_ST_ERR
;
268 /* don't push the buffering BIO quite yet */
270 s
->state
= SSL3_ST_CW_CLNT_HELLO_A
;
271 s
->ctx
->stats
.sess_connect
++;
273 /* mark client_random uninitialized */
274 memset(s
->s3
->client_random
, 0, sizeof(s
->s3
->client_random
));
275 s
->d1
->send_cookie
= 0;
277 s
->d1
->change_cipher_spec_ok
= 0;
279 * Should have been reset by ssl3_get_finished, too.
281 s
->s3
->change_cipher_spec
= 0;
284 #ifndef OPENSSL_NO_SCTP
285 case DTLS1_SCTP_ST_CR_READ_SOCK
:
287 if (BIO_dgram_sctp_msg_waiting(SSL_get_rbio(s
))) {
288 s
->s3
->in_read_app_data
= 2;
289 s
->rwstate
= SSL_READING
;
290 BIO_clear_retry_flags(SSL_get_rbio(s
));
291 BIO_set_retry_read(SSL_get_rbio(s
));
296 s
->state
= s
->s3
->tmp
.next_state
;
299 case DTLS1_SCTP_ST_CW_WRITE_SOCK
:
300 /* read app data until dry event */
302 ret
= BIO_dgram_sctp_wait_for_dry(SSL_get_wbio(s
));
307 s
->s3
->in_read_app_data
= 2;
308 s
->rwstate
= SSL_READING
;
309 BIO_clear_retry_flags(SSL_get_rbio(s
));
310 BIO_set_retry_read(SSL_get_rbio(s
));
315 s
->state
= s
->d1
->next_state
;
319 case SSL3_ST_CW_CLNT_HELLO_A
:
322 /* every DTLS ClientHello resets Finished MAC */
323 if (!ssl3_init_finished_mac(s
)) {
325 s
->state
= SSL_ST_ERR
;
330 case SSL3_ST_CW_CLNT_HELLO_B
:
331 dtls1_start_timer(s
);
332 ret
= ssl3_client_hello(s
);
336 if (s
->d1
->send_cookie
) {
337 s
->state
= SSL3_ST_CW_FLUSH
;
338 s
->s3
->tmp
.next_state
= SSL3_ST_CR_SRVR_HELLO_A
;
340 s
->state
= SSL3_ST_CR_SRVR_HELLO_A
;
344 #ifndef OPENSSL_NO_SCTP
345 /* Disable buffering for SCTP */
346 if (!BIO_dgram_is_sctp(SSL_get_wbio(s
))) {
349 * turn on buffering for the next lot of output
351 if (s
->bbio
!= s
->wbio
)
352 s
->wbio
= BIO_push(s
->bbio
, s
->wbio
);
353 #ifndef OPENSSL_NO_SCTP
359 case SSL3_ST_CR_SRVR_HELLO_A
:
360 case SSL3_ST_CR_SRVR_HELLO_B
:
361 ret
= ssl3_get_server_hello(s
);
366 #ifndef OPENSSL_NO_SCTP
368 * Add new shared key for SCTP-Auth, will be ignored if
371 snprintf((char *)labelbuffer
,
372 sizeof(DTLS1_SCTP_AUTH_LABEL
),
373 DTLS1_SCTP_AUTH_LABEL
);
375 if (SSL_export_keying_material(s
, sctpauthkey
,
378 sizeof(labelbuffer
), NULL
, 0,
381 s
->state
= SSL_ST_ERR
;
385 BIO_ctrl(SSL_get_wbio(s
),
386 BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY
,
387 sizeof(sctpauthkey
), sctpauthkey
);
390 s
->state
= SSL3_ST_CR_FINISHED_A
;
391 if (s
->tlsext_ticket_expected
) {
392 /* receive renewed session ticket */
393 s
->state
= SSL3_ST_CR_SESSION_TICKET_A
;
396 s
->state
= DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A
;
401 case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A
:
402 case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B
:
404 ret
= dtls1_get_hello_verify(s
);
408 if (s
->d1
->send_cookie
) /* start again, with a cookie */
409 s
->state
= SSL3_ST_CW_CLNT_HELLO_A
;
411 s
->state
= SSL3_ST_CR_CERT_A
;
415 case SSL3_ST_CR_CERT_A
:
416 case SSL3_ST_CR_CERT_B
:
417 /* Check if it is anon DH or PSK */
418 if (!(s
->s3
->tmp
.new_cipher
->algorithm_auth
& SSL_aNULL
) &&
419 !(s
->s3
->tmp
.new_cipher
->algorithm_mkey
& SSL_kPSK
)) {
420 ret
= ssl3_get_server_certificate(s
);
423 #ifndef OPENSSL_NO_TLSEXT
424 if (s
->tlsext_status_expected
)
425 s
->state
= SSL3_ST_CR_CERT_STATUS_A
;
427 s
->state
= SSL3_ST_CR_KEY_EXCH_A
;
430 s
->state
= SSL3_ST_CR_KEY_EXCH_A
;
436 s
->state
= SSL3_ST_CR_KEY_EXCH_A
;
441 case SSL3_ST_CR_KEY_EXCH_A
:
442 case SSL3_ST_CR_KEY_EXCH_B
:
443 ret
= ssl3_get_key_exchange(s
);
446 s
->state
= SSL3_ST_CR_CERT_REQ_A
;
450 * at this point we check that we have the required stuff from
453 if (!ssl3_check_cert_and_algorithm(s
)) {
455 s
->state
= SSL_ST_ERR
;
460 case SSL3_ST_CR_CERT_REQ_A
:
461 case SSL3_ST_CR_CERT_REQ_B
:
462 ret
= ssl3_get_certificate_request(s
);
465 s
->state
= SSL3_ST_CR_SRVR_DONE_A
;
469 case SSL3_ST_CR_SRVR_DONE_A
:
470 case SSL3_ST_CR_SRVR_DONE_B
:
471 ret
= ssl3_get_server_done(s
);
475 if (s
->s3
->tmp
.cert_req
)
476 s
->s3
->tmp
.next_state
= SSL3_ST_CW_CERT_A
;
478 s
->s3
->tmp
.next_state
= SSL3_ST_CW_KEY_EXCH_A
;
481 #ifndef OPENSSL_NO_SCTP
482 if (BIO_dgram_is_sctp(SSL_get_wbio(s
)) &&
483 state
== SSL_ST_RENEGOTIATE
)
484 s
->state
= DTLS1_SCTP_ST_CR_READ_SOCK
;
487 s
->state
= s
->s3
->tmp
.next_state
;
490 case SSL3_ST_CW_CERT_A
:
491 case SSL3_ST_CW_CERT_B
:
492 case SSL3_ST_CW_CERT_C
:
493 case SSL3_ST_CW_CERT_D
:
494 dtls1_start_timer(s
);
495 ret
= ssl3_send_client_certificate(s
);
498 s
->state
= SSL3_ST_CW_KEY_EXCH_A
;
502 case SSL3_ST_CW_KEY_EXCH_A
:
503 case SSL3_ST_CW_KEY_EXCH_B
:
504 dtls1_start_timer(s
);
505 ret
= ssl3_send_client_key_exchange(s
);
509 #ifndef OPENSSL_NO_SCTP
511 * Add new shared key for SCTP-Auth, will be ignored if no SCTP
514 snprintf((char *)labelbuffer
, sizeof(DTLS1_SCTP_AUTH_LABEL
),
515 DTLS1_SCTP_AUTH_LABEL
);
517 if (SSL_export_keying_material(s
, sctpauthkey
,
518 sizeof(sctpauthkey
), labelbuffer
,
519 sizeof(labelbuffer
), NULL
, 0, 0) <= 0) {
521 s
->state
= SSL_ST_ERR
;
525 BIO_ctrl(SSL_get_wbio(s
), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY
,
526 sizeof(sctpauthkey
), sctpauthkey
);
530 * EAY EAY EAY need to check for DH fix cert sent back
533 * For TLS, cert_req is set to 2, so a cert chain of nothing is
534 * sent, but no verify packet is sent
536 if (s
->s3
->tmp
.cert_req
== 1) {
537 s
->state
= SSL3_ST_CW_CERT_VRFY_A
;
539 #ifndef OPENSSL_NO_SCTP
540 if (BIO_dgram_is_sctp(SSL_get_wbio(s
))) {
541 s
->d1
->next_state
= SSL3_ST_CW_CHANGE_A
;
542 s
->state
= DTLS1_SCTP_ST_CW_WRITE_SOCK
;
545 s
->state
= SSL3_ST_CW_CHANGE_A
;
551 case SSL3_ST_CW_CERT_VRFY_A
:
552 case SSL3_ST_CW_CERT_VRFY_B
:
553 dtls1_start_timer(s
);
554 ret
= ssl3_send_client_verify(s
);
557 #ifndef OPENSSL_NO_SCTP
558 if (BIO_dgram_is_sctp(SSL_get_wbio(s
))) {
559 s
->d1
->next_state
= SSL3_ST_CW_CHANGE_A
;
560 s
->state
= DTLS1_SCTP_ST_CW_WRITE_SOCK
;
563 s
->state
= SSL3_ST_CW_CHANGE_A
;
567 case SSL3_ST_CW_CHANGE_A
:
568 case SSL3_ST_CW_CHANGE_B
:
570 dtls1_start_timer(s
);
571 ret
= dtls1_send_change_cipher_spec(s
,
573 SSL3_ST_CW_CHANGE_B
);
577 s
->state
= SSL3_ST_CW_FINISHED_A
;
580 s
->session
->cipher
= s
->s3
->tmp
.new_cipher
;
581 #ifdef OPENSSL_NO_COMP
582 s
->session
->compress_meth
= 0;
584 if (s
->s3
->tmp
.new_compression
== NULL
)
585 s
->session
->compress_meth
= 0;
587 s
->session
->compress_meth
= s
->s3
->tmp
.new_compression
->id
;
589 if (!s
->method
->ssl3_enc
->setup_key_block(s
)) {
591 s
->state
= SSL_ST_ERR
;
595 if (!s
->method
->ssl3_enc
->change_cipher_state(s
,
596 SSL3_CHANGE_CIPHER_CLIENT_WRITE
))
599 s
->state
= SSL_ST_ERR
;
602 #ifndef OPENSSL_NO_SCTP
605 * Change to new shared key of SCTP-Auth, will be ignored if
608 BIO_ctrl(SSL_get_wbio(s
), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY
,
613 dtls1_reset_seq_numbers(s
, SSL3_CC_WRITE
);
616 case SSL3_ST_CW_FINISHED_A
:
617 case SSL3_ST_CW_FINISHED_B
:
619 dtls1_start_timer(s
);
620 ret
= ssl3_send_finished(s
,
621 SSL3_ST_CW_FINISHED_A
,
622 SSL3_ST_CW_FINISHED_B
,
624 ssl3_enc
->client_finished_label
,
626 ssl3_enc
->client_finished_label_len
);
629 s
->state
= SSL3_ST_CW_FLUSH
;
632 s
->s3
->flags
&= ~SSL3_FLAGS_POP_BUFFER
;
634 s
->s3
->tmp
.next_state
= SSL_ST_OK
;
635 #ifndef OPENSSL_NO_SCTP
636 if (BIO_dgram_is_sctp(SSL_get_wbio(s
))) {
637 s
->d1
->next_state
= s
->s3
->tmp
.next_state
;
638 s
->s3
->tmp
.next_state
= DTLS1_SCTP_ST_CW_WRITE_SOCK
;
641 if (s
->s3
->flags
& SSL3_FLAGS_DELAY_CLIENT_FINISHED
) {
642 s
->state
= SSL_ST_OK
;
643 #ifndef OPENSSL_NO_SCTP
644 if (BIO_dgram_is_sctp(SSL_get_wbio(s
))) {
645 s
->d1
->next_state
= SSL_ST_OK
;
646 s
->state
= DTLS1_SCTP_ST_CW_WRITE_SOCK
;
649 s
->s3
->flags
|= SSL3_FLAGS_POP_BUFFER
;
650 s
->s3
->delay_buf_pop_ret
= 0;
653 #ifndef OPENSSL_NO_SCTP
655 * Change to new shared key of SCTP-Auth, will be ignored if
658 BIO_ctrl(SSL_get_wbio(s
), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY
,
662 #ifndef OPENSSL_NO_TLSEXT
664 * Allow NewSessionTicket if ticket expected
666 if (s
->tlsext_ticket_expected
)
667 s
->s3
->tmp
.next_state
= SSL3_ST_CR_SESSION_TICKET_A
;
671 s
->s3
->tmp
.next_state
= SSL3_ST_CR_FINISHED_A
;
676 #ifndef OPENSSL_NO_TLSEXT
677 case SSL3_ST_CR_SESSION_TICKET_A
:
678 case SSL3_ST_CR_SESSION_TICKET_B
:
679 ret
= ssl3_get_new_session_ticket(s
);
682 s
->state
= SSL3_ST_CR_FINISHED_A
;
686 case SSL3_ST_CR_CERT_STATUS_A
:
687 case SSL3_ST_CR_CERT_STATUS_B
:
688 ret
= ssl3_get_cert_status(s
);
691 s
->state
= SSL3_ST_CR_KEY_EXCH_A
;
696 case SSL3_ST_CR_FINISHED_A
:
697 case SSL3_ST_CR_FINISHED_B
:
698 s
->d1
->change_cipher_spec_ok
= 1;
699 ret
= ssl3_get_finished(s
, SSL3_ST_CR_FINISHED_A
,
700 SSL3_ST_CR_FINISHED_B
);
706 s
->state
= SSL3_ST_CW_CHANGE_A
;
708 s
->state
= SSL_ST_OK
;
710 #ifndef OPENSSL_NO_SCTP
711 if (BIO_dgram_is_sctp(SSL_get_wbio(s
)) &&
712 state
== SSL_ST_RENEGOTIATE
) {
713 s
->d1
->next_state
= s
->state
;
714 s
->state
= DTLS1_SCTP_ST_CW_WRITE_SOCK
;
721 case SSL3_ST_CW_FLUSH
:
722 s
->rwstate
= SSL_WRITING
;
723 if (BIO_flush(s
->wbio
) <= 0) {
725 * If the write error was fatal, stop trying
727 if (!BIO_should_retry(s
->wbio
)) {
728 s
->rwstate
= SSL_NOTHING
;
729 s
->state
= s
->s3
->tmp
.next_state
;
735 s
->rwstate
= SSL_NOTHING
;
736 s
->state
= s
->s3
->tmp
.next_state
;
740 /* clean a few things up */
741 ssl3_cleanup_key_block(s
);
744 if (s
->init_buf
!= NULL
) {
745 BUF_MEM_free(s
->init_buf
);
751 * If we are not 'joining' the last two packets, remove the
754 if (!(s
->s3
->flags
& SSL3_FLAGS_POP_BUFFER
))
755 ssl_free_wbio_buffer(s
);
756 /* else do it later in ssl3_write */
762 ssl_update_cache(s
, SSL_SESS_CACHE_CLIENT
);
764 s
->ctx
->stats
.sess_hit
++;
768 s
->handshake_func
= dtls1_connect
;
769 s
->ctx
->stats
.sess_connect_good
++;
772 cb(s
, SSL_CB_HANDSHAKE_DONE
, 1);
774 /* done with handshaking */
775 s
->d1
->handshake_read_seq
= 0;
776 s
->d1
->next_handshake_write_seq
= 0;
777 dtls1_clear_received_buffer(s
);
783 SSLerr(SSL_F_DTLS1_CONNECT
, SSL_R_UNKNOWN_STATE
);
789 /* did we do anything */
790 if (!s
->s3
->tmp
.reuse_message
&& !skip
) {
792 if ((ret
= BIO_flush(s
->wbio
)) <= 0)
796 if ((cb
!= NULL
) && (s
->state
!= state
)) {
797 new_state
= s
->state
;
799 cb(s
, SSL_CB_CONNECT_LOOP
, 1);
800 s
->state
= new_state
;
808 #ifndef OPENSSL_NO_SCTP
810 * Notify SCTP BIO socket to leave handshake mode and allow stream
811 * identifier other than 0. Will be ignored if no SCTP is used.
813 BIO_ctrl(SSL_get_wbio(s
), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE
,
814 s
->in_handshake
, NULL
);
820 cb(s
, SSL_CB_CONNECT_EXIT
, ret
);
824 static int dtls1_get_hello_verify(SSL
*s
)
828 unsigned int cookie_len
;
831 n
= s
->method
->ssl_get_message(s
,
832 DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A
,
833 DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B
,
834 -1, s
->max_cert_list
, &ok
);
840 if (s
->s3
->tmp
.message_type
!= DTLS1_MT_HELLO_VERIFY_REQUEST
) {
841 s
->d1
->send_cookie
= 0;
842 s
->s3
->tmp
.reuse_message
= 1;
846 data
= (unsigned char *)s
->init_msg
;
848 if (s
->method
->version
!= DTLS_ANY_VERSION
&&
849 ((data
[0] != (s
->version
>> 8)) || (data
[1] != (s
->version
& 0xff))))
851 SSLerr(SSL_F_DTLS1_GET_HELLO_VERIFY
, SSL_R_WRONG_SSL_VERSION
);
852 s
->version
= (s
->version
& 0xff00) | data
[1];
853 al
= SSL_AD_PROTOCOL_VERSION
;
859 cookie_len
= *(data
++);
860 if (cookie_len
> sizeof(s
->d1
->cookie
)) {
861 al
= SSL_AD_ILLEGAL_PARAMETER
;
865 memcpy(s
->d1
->cookie
, data
, cookie_len
);
866 s
->d1
->cookie_len
= cookie_len
;
868 s
->d1
->send_cookie
= 1;
872 ssl3_send_alert(s
, SSL3_AL_FATAL
, al
);
873 s
->state
= SSL_ST_ERR
;