3 * DTLS implementation written by Nagendra Modadugu
4 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
6 /* ====================================================================
7 * Copyright (c) 1999-2007 The OpenSSL Project. All rights reserved.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in
18 * the documentation and/or other materials provided with the
21 * 3. All advertising materials mentioning features or use of this
22 * software must display the following acknowledgment:
23 * "This product includes software developed by the OpenSSL Project
24 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
26 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
27 * endorse or promote products derived from this software without
28 * prior written permission. For written permission, please contact
29 * openssl-core@OpenSSL.org.
31 * 5. Products derived from this software may not be called "OpenSSL"
32 * nor may "OpenSSL" appear in their names without prior written
33 * permission of the OpenSSL Project.
35 * 6. Redistributions of any form whatsoever must retain the following
37 * "This product includes software developed by the OpenSSL Project
38 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
40 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
41 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
43 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
44 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
45 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
46 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
47 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
49 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
50 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
51 * OF THE POSSIBILITY OF SUCH DAMAGE.
52 * ====================================================================
54 * This product includes cryptographic software written by Eric Young
55 * (eay@cryptsoft.com). This product includes software written by Tim
56 * Hudson (tjh@cryptsoft.com).
59 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
60 * All rights reserved.
62 * This package is an SSL implementation written
63 * by Eric Young (eay@cryptsoft.com).
64 * The implementation was written so as to conform with Netscapes SSL.
66 * This library is free for commercial and non-commercial use as long as
67 * the following conditions are aheared to. The following conditions
68 * apply to all code found in this distribution, be it the RC4, RSA,
69 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
70 * included with this distribution is covered by the same copyright terms
71 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
73 * Copyright remains Eric Young's, and as such any Copyright notices in
74 * the code are not to be removed.
75 * If this package is used in a product, Eric Young should be given attribution
76 * as the author of the parts of the library used.
77 * This can be in the form of a textual message at program startup or
78 * in documentation (online or textual) provided with the package.
80 * Redistribution and use in source and binary forms, with or without
81 * modification, are permitted provided that the following conditions
83 * 1. Redistributions of source code must retain the copyright
84 * notice, this list of conditions and the following disclaimer.
85 * 2. Redistributions in binary form must reproduce the above copyright
86 * notice, this list of conditions and the following disclaimer in the
87 * documentation and/or other materials provided with the distribution.
88 * 3. All advertising materials mentioning features or use of this software
89 * must display the following acknowledgement:
90 * "This product includes cryptographic software written by
91 * Eric Young (eay@cryptsoft.com)"
92 * The word 'cryptographic' can be left out if the rouines from the library
93 * being used are not cryptographic related :-).
94 * 4. If you include any Windows specific code (or a derivative thereof) from
95 * the apps directory (application code) you must include an acknowledgement:
96 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
98 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
99 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
100 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
101 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
102 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
103 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
104 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
105 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
106 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
107 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
110 * The licence and distribution terms for any publically available version or
111 * derivative of this code cannot be changed. i.e. this code cannot simply be
112 * copied and put under another distribution licence
113 * [including the GNU Public Licence.]
117 #include "ssl_locl.h"
118 #include <openssl/buffer.h>
119 #include <openssl/rand.h>
120 #include <openssl/objects.h>
121 #include <openssl/evp.h>
122 #include <openssl/x509.h>
123 #include <openssl/md5.h>
124 #include <openssl/bn.h>
125 #ifndef OPENSSL_NO_DH
126 # include <openssl/dh.h>
129 static const SSL_METHOD
*dtls1_get_server_method(int ver
);
130 static int dtls1_send_hello_verify_request(SSL
*s
);
132 static const SSL_METHOD
*dtls1_get_server_method(int ver
)
134 if (ver
== DTLS_ANY_VERSION
)
135 return DTLS_server_method();
136 else if (ver
== DTLS1_VERSION
)
137 return DTLSv1_server_method();
138 else if (ver
== DTLS1_2_VERSION
)
139 return DTLSv1_2_server_method();
144 IMPLEMENT_dtls1_meth_func(DTLS1_VERSION
,
145 DTLSv1_server_method
,
147 ssl_undefined_function
,
148 dtls1_get_server_method
, DTLSv1_enc_data
)
150 IMPLEMENT_dtls1_meth_func(DTLS1_2_VERSION
,
151 DTLSv1_2_server_method
,
153 ssl_undefined_function
,
154 dtls1_get_server_method
, DTLSv1_2_enc_data
)
156 IMPLEMENT_dtls1_meth_func(DTLS_ANY_VERSION
,
159 ssl_undefined_function
,
160 dtls1_get_server_method
, DTLSv1_2_enc_data
)
162 int dtls1_accept(SSL
*s
)
165 unsigned long Time
= (unsigned long)time(NULL
);
166 void (*cb
) (const SSL
*ssl
, int type
, int val
) = NULL
;
169 int new_state
, state
, skip
= 0;
171 #ifndef OPENSSL_NO_SCTP
172 unsigned char sctpauthkey
[64];
173 char labelbuffer
[sizeof(DTLS1_SCTP_AUTH_LABEL
)];
176 RAND_add(&Time
, sizeof(Time
), 0);
180 if (s
->info_callback
!= NULL
)
181 cb
= s
->info_callback
;
182 else if (s
->ctx
->info_callback
!= NULL
)
183 cb
= s
->ctx
->info_callback
;
185 listen
= s
->d1
->listen
;
187 /* init things to blank */
189 if (!SSL_in_init(s
) || SSL_in_before(s
))
192 s
->d1
->listen
= listen
;
193 #ifndef OPENSSL_NO_SCTP
195 * Notify SCTP BIO socket to enter handshake mode and prevent stream
196 * identifier other than 0. Will be ignored if no SCTP is used.
198 BIO_ctrl(SSL_get_wbio(s
), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE
,
199 s
->in_handshake
, NULL
);
202 if (s
->cert
== NULL
) {
203 SSLerr(SSL_F_DTLS1_ACCEPT
, SSL_R_NO_CERTIFICATE_SET
);
206 #ifndef OPENSSL_NO_HEARTBEATS
208 * If we're awaiting a HeartbeatResponse, pretend we already got and
209 * don't await it anymore, because Heartbeats don't make sense during
212 if (s
->tlsext_hb_pending
) {
214 s
->tlsext_hb_pending
= 0;
223 case SSL_ST_RENEGOTIATE
:
225 /* s->state=SSL_ST_ACCEPT; */
229 case SSL_ST_BEFORE
| SSL_ST_ACCEPT
:
230 case SSL_ST_OK
| SSL_ST_ACCEPT
:
234 cb(s
, SSL_CB_HANDSHAKE_START
, 1);
236 if ((s
->version
& 0xff00) != (DTLS1_VERSION
& 0xff00)) {
237 SSLerr(SSL_F_DTLS1_ACCEPT
, ERR_R_INTERNAL_ERROR
);
240 s
->type
= SSL_ST_ACCEPT
;
242 if (s
->init_buf
== NULL
) {
243 if ((buf
= BUF_MEM_new()) == NULL
) {
245 s
->state
= SSL_ST_ERR
;
248 if (!BUF_MEM_grow(buf
, SSL3_RT_MAX_PLAIN_LENGTH
)) {
251 s
->state
= SSL_ST_ERR
;
257 if (!ssl3_setup_buffers(s
)) {
259 s
->state
= SSL_ST_ERR
;
264 s
->d1
->change_cipher_spec_ok
= 0;
266 * Should have been reset by ssl3_get_finished, too.
268 s
->s3
->change_cipher_spec
= 0;
270 if (s
->state
!= SSL_ST_RENEGOTIATE
) {
272 * Ok, we now need to push on a buffering BIO so that the
273 * output is sent in a way that TCP likes :-) ...but not with
276 #ifndef OPENSSL_NO_SCTP
277 if (!BIO_dgram_is_sctp(SSL_get_wbio(s
)))
279 if (!ssl_init_wbio_buffer(s
, 1)) {
281 s
->state
= SSL_ST_ERR
;
285 if (!ssl3_init_finished_mac(s
)) {
287 s
->state
= SSL_ST_ERR
;
291 s
->state
= SSL3_ST_SR_CLNT_HELLO_A
;
292 s
->ctx
->stats
.sess_accept
++;
293 } else if (!s
->s3
->send_connection_binding
&&
295 SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
)) {
297 * Server attempting to renegotiate with client that doesn't
298 * support secure renegotiation.
300 SSLerr(SSL_F_DTLS1_ACCEPT
,
301 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED
);
302 ssl3_send_alert(s
, SSL3_AL_FATAL
, SSL_AD_HANDSHAKE_FAILURE
);
304 s
->state
= SSL_ST_ERR
;
308 * s->state == SSL_ST_RENEGOTIATE, we will just send a
311 s
->ctx
->stats
.sess_accept_renegotiate
++;
312 s
->state
= SSL3_ST_SW_HELLO_REQ_A
;
317 case SSL3_ST_SW_HELLO_REQ_A
:
318 case SSL3_ST_SW_HELLO_REQ_B
:
321 dtls1_clear_sent_buffer(s
);
322 dtls1_start_timer(s
);
323 ret
= ssl3_send_hello_request(s
);
326 s
->s3
->tmp
.next_state
= SSL3_ST_SR_CLNT_HELLO_A
;
327 s
->state
= SSL3_ST_SW_FLUSH
;
330 if (!ssl3_init_finished_mac(s
)) {
332 s
->state
= SSL_ST_ERR
;
337 case SSL3_ST_SW_HELLO_REQ_C
:
338 s
->state
= SSL_ST_OK
;
341 case SSL3_ST_SR_CLNT_HELLO_A
:
342 case SSL3_ST_SR_CLNT_HELLO_B
:
343 case SSL3_ST_SR_CLNT_HELLO_C
:
346 ret
= ssl3_get_client_hello(s
);
351 if (ret
== 1 && (SSL_get_options(s
) & SSL_OP_COOKIE_EXCHANGE
))
352 s
->state
= DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A
;
354 s
->state
= SSL3_ST_SW_SRVR_HELLO_A
;
358 /* If we're just listening, stop here */
359 if (listen
&& s
->state
== SSL3_ST_SW_SRVR_HELLO_A
) {
363 * Set expected sequence numbers to continue the handshake.
365 s
->d1
->handshake_read_seq
= 2;
366 s
->d1
->handshake_write_seq
= 1;
367 s
->d1
->next_handshake_write_seq
= 1;
373 case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A
:
374 case DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B
:
376 ret
= dtls1_send_hello_verify_request(s
);
379 s
->state
= SSL3_ST_SW_FLUSH
;
380 s
->s3
->tmp
.next_state
= SSL3_ST_SR_CLNT_HELLO_A
;
382 /* HelloVerifyRequest resets Finished MAC */
383 if (s
->version
!= DTLS1_BAD_VER
)
384 if (!ssl3_init_finished_mac(s
)) {
386 s
->state
= SSL_ST_ERR
;
391 #ifndef OPENSSL_NO_SCTP
392 case DTLS1_SCTP_ST_SR_READ_SOCK
:
394 if (BIO_dgram_sctp_msg_waiting(SSL_get_rbio(s
))) {
395 s
->s3
->in_read_app_data
= 2;
396 s
->rwstate
= SSL_READING
;
397 BIO_clear_retry_flags(SSL_get_rbio(s
));
398 BIO_set_retry_read(SSL_get_rbio(s
));
403 s
->state
= SSL3_ST_SR_FINISHED_A
;
406 case DTLS1_SCTP_ST_SW_WRITE_SOCK
:
407 ret
= BIO_dgram_sctp_wait_for_dry(SSL_get_wbio(s
));
412 if (s
->d1
->next_state
!= SSL_ST_OK
) {
413 s
->s3
->in_read_app_data
= 2;
414 s
->rwstate
= SSL_READING
;
415 BIO_clear_retry_flags(SSL_get_rbio(s
));
416 BIO_set_retry_read(SSL_get_rbio(s
));
422 s
->state
= s
->d1
->next_state
;
426 case SSL3_ST_SW_SRVR_HELLO_A
:
427 case SSL3_ST_SW_SRVR_HELLO_B
:
429 dtls1_start_timer(s
);
430 ret
= ssl3_send_server_hello(s
);
435 #ifndef OPENSSL_NO_SCTP
437 * Add new shared key for SCTP-Auth, will be ignored if no
440 snprintf((char *)labelbuffer
, sizeof(DTLS1_SCTP_AUTH_LABEL
),
441 DTLS1_SCTP_AUTH_LABEL
);
443 if (SSL_export_keying_material(s
, sctpauthkey
,
444 sizeof(sctpauthkey
), labelbuffer
,
445 sizeof(labelbuffer
), NULL
, 0, 0) <= 0) {
447 s
->state
= SSL_ST_ERR
;
451 BIO_ctrl(SSL_get_wbio(s
), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY
,
452 sizeof(sctpauthkey
), sctpauthkey
);
454 #ifndef OPENSSL_NO_TLSEXT
455 if (s
->tlsext_ticket_expected
)
456 s
->state
= SSL3_ST_SW_SESSION_TICKET_A
;
458 s
->state
= SSL3_ST_SW_CHANGE_A
;
460 s
->state
= SSL3_ST_SW_CHANGE_A
;
463 s
->state
= SSL3_ST_SW_CERT_A
;
467 case SSL3_ST_SW_CERT_A
:
468 case SSL3_ST_SW_CERT_B
:
469 /* Check if it is anon DH or normal PSK */
470 if (!(s
->s3
->tmp
.new_cipher
->algorithm_auth
& SSL_aNULL
)
471 && !(s
->s3
->tmp
.new_cipher
->algorithm_mkey
& SSL_kPSK
)) {
472 dtls1_start_timer(s
);
473 ret
= ssl3_send_server_certificate(s
);
476 #ifndef OPENSSL_NO_TLSEXT
477 if (s
->tlsext_status_expected
)
478 s
->state
= SSL3_ST_SW_CERT_STATUS_A
;
480 s
->state
= SSL3_ST_SW_KEY_EXCH_A
;
483 s
->state
= SSL3_ST_SW_KEY_EXCH_A
;
489 s
->state
= SSL3_ST_SW_KEY_EXCH_A
;
494 case SSL3_ST_SW_KEY_EXCH_A
:
495 case SSL3_ST_SW_KEY_EXCH_B
:
496 alg_k
= s
->s3
->tmp
.new_cipher
->algorithm_mkey
;
499 * clear this, it may get reset by
500 * send_server_key_exchange
502 s
->s3
->tmp
.use_rsa_tmp
= 0;
505 * only send if a DH key exchange or RSA but we have a sign only
510 * PSK: send ServerKeyExchange if PSK identity hint if
513 #ifndef OPENSSL_NO_PSK
514 || ((alg_k
& SSL_kPSK
) && s
->ctx
->psk_identity_hint
)
516 || (alg_k
& SSL_kDHE
)
517 || (alg_k
& SSL_kEECDH
)
518 || ((alg_k
& SSL_kRSA
)
519 && (s
->cert
->pkeys
[SSL_PKEY_RSA_ENC
].privatekey
== NULL
520 || (SSL_C_IS_EXPORT(s
->s3
->tmp
.new_cipher
)
521 && EVP_PKEY_size(s
->cert
->pkeys
522 [SSL_PKEY_RSA_ENC
].privatekey
) *
523 8 > SSL_C_EXPORT_PKEYLENGTH(s
->s3
->tmp
.new_cipher
)
528 dtls1_start_timer(s
);
529 ret
= ssl3_send_server_key_exchange(s
);
535 s
->state
= SSL3_ST_SW_CERT_REQ_A
;
539 case SSL3_ST_SW_CERT_REQ_A
:
540 case SSL3_ST_SW_CERT_REQ_B
:
541 if ( /* don't request cert unless asked for it: */
542 !(s
->verify_mode
& SSL_VERIFY_PEER
) ||
544 * if SSL_VERIFY_CLIENT_ONCE is set, don't request cert
545 * during re-negotiation:
547 ((s
->session
->peer
!= NULL
) &&
548 (s
->verify_mode
& SSL_VERIFY_CLIENT_ONCE
)) ||
550 * never request cert in anonymous ciphersuites (see
551 * section "Certificate request" in SSL 3 drafts and in
554 ((s
->s3
->tmp
.new_cipher
->algorithm_auth
& SSL_aNULL
) &&
556 * ... except when the application insists on
557 * verification (against the specs, but s3_clnt.c accepts
560 !(s
->verify_mode
& SSL_VERIFY_FAIL_IF_NO_PEER_CERT
)) ||
562 * never request cert in Kerberos ciphersuites
564 (s
->s3
->tmp
.new_cipher
->algorithm_auth
& SSL_aKRB5
)
566 * With normal PSK Certificates and Certificate Requests
569 || (s
->s3
->tmp
.new_cipher
->algorithm_mkey
& SSL_kPSK
)) {
570 /* no cert request */
572 s
->s3
->tmp
.cert_request
= 0;
573 s
->state
= SSL3_ST_SW_SRVR_DONE_A
;
574 #ifndef OPENSSL_NO_SCTP
575 if (BIO_dgram_is_sctp(SSL_get_wbio(s
))) {
576 s
->d1
->next_state
= SSL3_ST_SW_SRVR_DONE_A
;
577 s
->state
= DTLS1_SCTP_ST_SW_WRITE_SOCK
;
581 s
->s3
->tmp
.cert_request
= 1;
582 dtls1_start_timer(s
);
583 ret
= ssl3_send_certificate_request(s
);
586 #ifndef NETSCAPE_HANG_BUG
587 s
->state
= SSL3_ST_SW_SRVR_DONE_A
;
588 # ifndef OPENSSL_NO_SCTP
589 if (BIO_dgram_is_sctp(SSL_get_wbio(s
))) {
590 s
->d1
->next_state
= SSL3_ST_SW_SRVR_DONE_A
;
591 s
->state
= DTLS1_SCTP_ST_SW_WRITE_SOCK
;
595 s
->state
= SSL3_ST_SW_FLUSH
;
596 s
->s3
->tmp
.next_state
= SSL3_ST_SR_CERT_A
;
597 # ifndef OPENSSL_NO_SCTP
598 if (BIO_dgram_is_sctp(SSL_get_wbio(s
))) {
599 s
->d1
->next_state
= s
->s3
->tmp
.next_state
;
600 s
->s3
->tmp
.next_state
= DTLS1_SCTP_ST_SW_WRITE_SOCK
;
608 case SSL3_ST_SW_SRVR_DONE_A
:
609 case SSL3_ST_SW_SRVR_DONE_B
:
610 dtls1_start_timer(s
);
611 ret
= ssl3_send_server_done(s
);
614 s
->s3
->tmp
.next_state
= SSL3_ST_SR_CERT_A
;
615 s
->state
= SSL3_ST_SW_FLUSH
;
619 case SSL3_ST_SW_FLUSH
:
620 s
->rwstate
= SSL_WRITING
;
621 if (BIO_flush(s
->wbio
) <= 0) {
623 * If the write error was fatal, stop trying
625 if (!BIO_should_retry(s
->wbio
)) {
626 s
->rwstate
= SSL_NOTHING
;
627 s
->state
= s
->s3
->tmp
.next_state
;
633 s
->rwstate
= SSL_NOTHING
;
634 s
->state
= s
->s3
->tmp
.next_state
;
637 case SSL3_ST_SR_CERT_A
:
638 case SSL3_ST_SR_CERT_B
:
639 if (s
->s3
->tmp
.cert_request
) {
640 ret
= ssl3_get_client_certificate(s
);
645 s
->state
= SSL3_ST_SR_KEY_EXCH_A
;
648 case SSL3_ST_SR_KEY_EXCH_A
:
649 case SSL3_ST_SR_KEY_EXCH_B
:
650 ret
= ssl3_get_client_key_exchange(s
);
653 #ifndef OPENSSL_NO_SCTP
655 * Add new shared key for SCTP-Auth, will be ignored if no SCTP
658 snprintf((char *)labelbuffer
, sizeof(DTLS1_SCTP_AUTH_LABEL
),
659 DTLS1_SCTP_AUTH_LABEL
);
661 if (SSL_export_keying_material(s
, sctpauthkey
,
662 sizeof(sctpauthkey
), labelbuffer
,
663 sizeof(labelbuffer
), NULL
, 0, 0) <= 0) {
665 s
->state
= SSL_ST_ERR
;
669 BIO_ctrl(SSL_get_wbio(s
), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY
,
670 sizeof(sctpauthkey
), sctpauthkey
);
673 s
->state
= SSL3_ST_SR_CERT_VRFY_A
;
678 * For the ECDH ciphersuites when the client sends its ECDH
679 * pub key in a certificate, the CertificateVerify message is
682 s
->state
= SSL3_ST_SR_FINISHED_A
;
684 } else if (SSL_USE_SIGALGS(s
)) {
685 s
->state
= SSL3_ST_SR_CERT_VRFY_A
;
687 if (!s
->session
->peer
)
690 * For sigalgs freeze the handshake buffer at this point and
691 * digest cached records.
693 if (!s
->s3
->handshake_buffer
) {
694 SSLerr(SSL_F_DTLS1_ACCEPT
, ERR_R_INTERNAL_ERROR
);
695 s
->state
= SSL_ST_ERR
;
698 s
->s3
->flags
|= TLS1_FLAGS_KEEP_HANDSHAKE
;
699 if (!ssl3_digest_cached_records(s
)) {
700 s
->state
= SSL_ST_ERR
;
704 s
->state
= SSL3_ST_SR_CERT_VRFY_A
;
708 * We need to get hashes here so if there is a client cert,
711 s
->method
->ssl3_enc
->cert_verify_mac(s
,
716 s
->method
->ssl3_enc
->cert_verify_mac(s
, NID_sha1
,
719 [MD5_DIGEST_LENGTH
]));
723 case SSL3_ST_SR_CERT_VRFY_A
:
724 case SSL3_ST_SR_CERT_VRFY_B
:
725 ret
= ssl3_get_cert_verify(s
);
728 #ifndef OPENSSL_NO_SCTP
729 if (BIO_dgram_is_sctp(SSL_get_wbio(s
)) &&
730 state
== SSL_ST_RENEGOTIATE
)
731 s
->state
= DTLS1_SCTP_ST_SR_READ_SOCK
;
734 s
->state
= SSL3_ST_SR_FINISHED_A
;
738 case SSL3_ST_SR_FINISHED_A
:
739 case SSL3_ST_SR_FINISHED_B
:
741 * Enable CCS. Receiving a CCS clears the flag, so make
742 * sure not to re-enable it to ban duplicates. This *should* be the
743 * first time we have received one - but we check anyway to be
745 * s->s3->change_cipher_spec is set when a CCS is
746 * processed in d1_pkt.c, and remains set until
747 * the client's Finished message is read.
749 if (!s
->s3
->change_cipher_spec
)
750 s
->d1
->change_cipher_spec_ok
= 1;
751 ret
= ssl3_get_finished(s
, SSL3_ST_SR_FINISHED_A
,
752 SSL3_ST_SR_FINISHED_B
);
757 s
->state
= SSL_ST_OK
;
758 #ifndef OPENSSL_NO_TLSEXT
759 else if (s
->tlsext_ticket_expected
)
760 s
->state
= SSL3_ST_SW_SESSION_TICKET_A
;
763 s
->state
= SSL3_ST_SW_CHANGE_A
;
767 #ifndef OPENSSL_NO_TLSEXT
768 case SSL3_ST_SW_SESSION_TICKET_A
:
769 case SSL3_ST_SW_SESSION_TICKET_B
:
770 ret
= ssl3_send_newsession_ticket(s
);
773 s
->state
= SSL3_ST_SW_CHANGE_A
;
777 case SSL3_ST_SW_CERT_STATUS_A
:
778 case SSL3_ST_SW_CERT_STATUS_B
:
779 ret
= ssl3_send_cert_status(s
);
782 s
->state
= SSL3_ST_SW_KEY_EXCH_A
;
788 case SSL3_ST_SW_CHANGE_A
:
789 case SSL3_ST_SW_CHANGE_B
:
791 s
->session
->cipher
= s
->s3
->tmp
.new_cipher
;
792 if (!s
->method
->ssl3_enc
->setup_key_block(s
)) {
794 s
->state
= SSL_ST_ERR
;
798 ret
= dtls1_send_change_cipher_spec(s
,
800 SSL3_ST_SW_CHANGE_B
);
805 #ifndef OPENSSL_NO_SCTP
808 * Change to new shared key of SCTP-Auth, will be ignored if
811 BIO_ctrl(SSL_get_wbio(s
), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY
,
816 s
->state
= SSL3_ST_SW_FINISHED_A
;
819 if (!s
->method
->ssl3_enc
->change_cipher_state(s
,
820 SSL3_CHANGE_CIPHER_SERVER_WRITE
))
823 s
->state
= SSL_ST_ERR
;
827 dtls1_reset_seq_numbers(s
, SSL3_CC_WRITE
);
830 case SSL3_ST_SW_FINISHED_A
:
831 case SSL3_ST_SW_FINISHED_B
:
832 ret
= ssl3_send_finished(s
,
833 SSL3_ST_SW_FINISHED_A
,
834 SSL3_ST_SW_FINISHED_B
,
836 ssl3_enc
->server_finished_label
,
838 ssl3_enc
->server_finished_label_len
);
841 s
->state
= SSL3_ST_SW_FLUSH
;
843 s
->s3
->tmp
.next_state
= SSL3_ST_SR_FINISHED_A
;
845 #ifndef OPENSSL_NO_SCTP
847 * Change to new shared key of SCTP-Auth, will be ignored if
850 BIO_ctrl(SSL_get_wbio(s
), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY
,
854 s
->s3
->tmp
.next_state
= SSL_ST_OK
;
855 #ifndef OPENSSL_NO_SCTP
856 if (BIO_dgram_is_sctp(SSL_get_wbio(s
))) {
857 s
->d1
->next_state
= s
->s3
->tmp
.next_state
;
858 s
->s3
->tmp
.next_state
= DTLS1_SCTP_ST_SW_WRITE_SOCK
;
866 /* clean a few things up */
867 ssl3_cleanup_key_block(s
);
870 BUF_MEM_free(s
->init_buf
);
874 /* remove buffering on output */
875 ssl_free_wbio_buffer(s
);
879 if (s
->renegotiate
== 2) { /* skipped if we just sent a
884 ssl_update_cache(s
, SSL_SESS_CACHE_SERVER
);
886 s
->ctx
->stats
.sess_accept_good
++;
888 s
->handshake_func
= dtls1_accept
;
891 cb(s
, SSL_CB_HANDSHAKE_DONE
, 1);
896 /* done handshaking, next message is client hello */
897 s
->d1
->handshake_read_seq
= 0;
898 /* next message is server hello */
899 s
->d1
->handshake_write_seq
= 0;
900 s
->d1
->next_handshake_write_seq
= 0;
901 dtls1_clear_received_buffer(s
);
907 SSLerr(SSL_F_DTLS1_ACCEPT
, SSL_R_UNKNOWN_STATE
);
913 if (!s
->s3
->tmp
.reuse_message
&& !skip
) {
915 if ((ret
= BIO_flush(s
->wbio
)) <= 0)
919 if ((cb
!= NULL
) && (s
->state
!= state
)) {
920 new_state
= s
->state
;
922 cb(s
, SSL_CB_ACCEPT_LOOP
, 1);
923 s
->state
= new_state
;
929 /* BIO_flush(s->wbio); */
932 #ifndef OPENSSL_NO_SCTP
934 * Notify SCTP BIO socket to leave handshake mode and prevent stream
935 * identifier other than 0. Will be ignored if no SCTP is used.
937 BIO_ctrl(SSL_get_wbio(s
), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE
,
938 s
->in_handshake
, NULL
);
942 cb(s
, SSL_CB_ACCEPT_EXIT
, ret
);
946 int dtls1_send_hello_verify_request(SSL
*s
)
948 unsigned int msg_len
;
949 unsigned char *msg
, *buf
, *p
;
951 if (s
->state
== DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A
) {
952 buf
= (unsigned char *)s
->init_buf
->data
;
954 msg
= p
= &(buf
[DTLS1_HM_HEADER_LENGTH
]);
955 /* Always use DTLS 1.0 version: see RFC 6347 */
956 *(p
++) = DTLS1_VERSION
>> 8;
957 *(p
++) = DTLS1_VERSION
& 0xFF;
959 if (s
->ctx
->app_gen_cookie_cb
== NULL
||
960 s
->ctx
->app_gen_cookie_cb(s
, s
->d1
->cookie
,
961 &(s
->d1
->cookie_len
)) == 0) {
962 SSLerr(SSL_F_DTLS1_SEND_HELLO_VERIFY_REQUEST
,
963 ERR_R_INTERNAL_ERROR
);
964 s
->state
= SSL_ST_ERR
;
968 *(p
++) = (unsigned char)s
->d1
->cookie_len
;
969 memcpy(p
, s
->d1
->cookie
, s
->d1
->cookie_len
);
970 p
+= s
->d1
->cookie_len
;
973 dtls1_set_message_header(s
, buf
,
974 DTLS1_MT_HELLO_VERIFY_REQUEST
, msg_len
, 0,
977 s
->state
= DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B
;
978 /* number of bytes to write */
979 s
->init_num
= p
- buf
;
983 /* s->state = DTLS1_ST_SW_HELLO_VERIFY_REQUEST_B */
984 return (dtls1_do_write(s
, SSL3_RT_HANDSHAKE
));