TLS server: Add internal callbacks get_failed, get_*_alerts

These can be used to implement cleaner termination of the handshake in
case of failures.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/crypto/tls_internal.c b/src/crypto/tls_internal.c
index 9c57ab25c59539776d9a9936d776238dbd448d0c..57b3e632df545e7c394f2a4579ef819064facea8 100644 (file)
--- a/src/crypto/tls_internal.c
+++ b/src/crypto/tls_internal.c
@@ -726,12 +726,20 @@ int tls_connection_client_hello_ext(void *tls_ctx, struct tls_connection *conn,
 
 int tls_connection_get_failed(void *tls_ctx, struct tls_connection *conn)
 {
+#ifdef CONFIG_TLS_INTERNAL_SERVER
+       if (conn->server)
+               return tlsv1_server_get_failed(conn->server);
+#endif /* CONFIG_TLS_INTERNAL_SERVER */
        return 0;
 }
 
 
 int tls_connection_get_read_alerts(void *tls_ctx, struct tls_connection *conn)
 {
+#ifdef CONFIG_TLS_INTERNAL_SERVER
+       if (conn->server)
+               return tlsv1_server_get_read_alerts(conn->server);
+#endif /* CONFIG_TLS_INTERNAL_SERVER */
        return 0;
 }
 
@@ -739,6 +747,10 @@ int tls_connection_get_read_alerts(void *tls_ctx, struct tls_connection *conn)
 int tls_connection_get_write_alerts(void *tls_ctx,
                                    struct tls_connection *conn)
 {
+#ifdef CONFIG_TLS_INTERNAL_SERVER
+       if (conn->server)
+               return tlsv1_server_get_write_alerts(conn->server);
+#endif /* CONFIG_TLS_INTERNAL_SERVER */
        return 0;
 }
 

diff --git a/src/tls/tlsv1_server.c b/src/tls/tlsv1_server.c
index 5406969040959ef7b97504a85ad7786e9df93b52..07840d4fbd3bfcfd7bba33b78532f7f2cf118326 100644 (file)
--- a/src/tls/tlsv1_server.c
+++ b/src/tls/tlsv1_server.c
@@ -204,6 +204,7 @@ failed:
                msg = tlsv1_server_send_alert(conn, conn->alert_level,
                                              conn->alert_description,
                                              out_len);
+               conn->write_alerts++;
        }
 
        return msg;
@@ -296,6 +297,7 @@ int tlsv1_server_decrypt(struct tlsv1_server *conn,
                        }
                        tlsv1_server_log(conn, "Received alert %d:%d",
                                         out_pos[0], out_pos[1]);
+                       conn->read_alerts++;
                        if (out_pos[0] == TLS_ALERT_LEVEL_WARNING) {
                                /* Continue processing */
                                pos += used;
@@ -708,6 +710,24 @@ void tlsv1_server_set_log_cb(struct tlsv1_server *conn,
 }
 
 
+int tlsv1_server_get_failed(struct tlsv1_server *conn)
+{
+       return conn->state == FAILED;
+}
+
+
+int tlsv1_server_get_read_alerts(struct tlsv1_server *conn)
+{
+       return conn->read_alerts;
+}
+
+
+int tlsv1_server_get_write_alerts(struct tlsv1_server *conn)
+{
+       return conn->write_alerts;
+}
+
+
 #ifdef CONFIG_TESTING_OPTIONS
 void tlsv1_server_set_test_flags(struct tlsv1_server *conn, u32 flags)
 {

diff --git a/src/tls/tlsv1_server.h b/src/tls/tlsv1_server.h
index 10e7699312b06fe80dbcc3b16a87a130af8e1c8a..c3fd37eb0b4b9b96d4bd9aacc8f3bab1915e2aa9 100644 (file)
--- a/src/tls/tlsv1_server.h
+++ b/src/tls/tlsv1_server.h
@@ -48,6 +48,10 @@ void tlsv1_server_set_session_ticket_cb(struct tlsv1_server *conn,
 void tlsv1_server_set_log_cb(struct tlsv1_server *conn,
                             void (*cb)(void *ctx, const char *msg), void *ctx);
 
+int tlsv1_server_get_failed(struct tlsv1_server *conn);
+int tlsv1_server_get_read_alerts(struct tlsv1_server *conn);
+int tlsv1_server_get_write_alerts(struct tlsv1_server *conn);
+
 void tlsv1_server_set_test_flags(struct tlsv1_server *conn, u32 flags);
 
 #endif /* TLSV1_SERVER_H */

diff --git a/src/tls/tlsv1_server_i.h b/src/tls/tlsv1_server_i.h
index 29c6678772150c8e813c307b0a54f370a5611276..2622585d84d0db635f20e95bebf8c7704d471b63 100644 (file)
--- a/src/tls/tlsv1_server_i.h
+++ b/src/tls/tlsv1_server_i.h
@@ -30,6 +30,8 @@ struct tlsv1_server {
        u8 alert_level;
        u8 alert_description;
 
+       int read_alerts, write_alerts;
+
        struct crypto_public_key *client_rsa_key;
 
        struct tls_verify_hash verify;