]>
Commit | Line | Data |
---|---|---|
846e33c7 | 1 | /* |
0789c7d8 | 2 | * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. |
c103c7e2 | 3 | * |
2c18d164 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
846e33c7 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
c103c7e2 MC |
8 | */ |
9 | ||
706457b7 | 10 | #include "ssl_local.h" |
c103c7e2 | 11 | |
38b051a1 | 12 | int ssl3_do_change_cipher_spec(SSL_CONNECTION *s) |
c103c7e2 MC |
13 | { |
14 | int i; | |
38b051a1 | 15 | SSL *ssl = SSL_CONNECTION_GET_SSL(s); |
c103c7e2 | 16 | |
49ae7423 | 17 | if (s->server) |
c103c7e2 MC |
18 | i = SSL3_CHANGE_CIPHER_SERVER_READ; |
19 | else | |
20 | i = SSL3_CHANGE_CIPHER_CLIENT_READ; | |
21 | ||
555cbb32 | 22 | if (s->s3.tmp.key_block == NULL) { |
c103c7e2 MC |
23 | if (s->session == NULL || s->session->master_key_length == 0) { |
24 | /* might happen if dtls1_read_bytes() calls this */ | |
6849b73c | 25 | ERR_raise(ERR_LIB_SSL, SSL_R_CCS_RECEIVED_EARLY); |
26a7d938 | 26 | return 0; |
c103c7e2 MC |
27 | } |
28 | ||
555cbb32 | 29 | s->session->cipher = s->s3.tmp.new_cipher; |
38b051a1 | 30 | if (!ssl->method->ssl3_enc->setup_key_block(s)) { |
157af9be | 31 | /* SSLfatal() already called */ |
26a7d938 | 32 | return 0; |
157af9be | 33 | } |
c103c7e2 MC |
34 | } |
35 | ||
38b051a1 | 36 | if (!ssl->method->ssl3_enc->change_cipher_state(s, i)) { |
157af9be | 37 | /* SSLfatal() already called */ |
26a7d938 | 38 | return 0; |
157af9be | 39 | } |
c103c7e2 | 40 | |
208fb891 | 41 | return 1; |
c103c7e2 MC |
42 | } |
43 | ||
38b051a1 | 44 | int ssl3_send_alert(SSL_CONNECTION *s, int level, int desc) |
c103c7e2 | 45 | { |
38b051a1 TM |
46 | SSL *ssl = SSL_CONNECTION_GET_SSL(s); |
47 | ||
c103c7e2 | 48 | /* Map tls/ssl alert value to correct one */ |
38b051a1 | 49 | if (SSL_CONNECTION_TREAT_AS_TLS13(s)) |
49e7fe12 MC |
50 | desc = tls13_alert_code(desc); |
51 | else | |
38b051a1 | 52 | desc = ssl->method->ssl3_enc->alert_value(desc); |
c103c7e2 MC |
53 | if (s->version == SSL3_VERSION && desc == SSL_AD_PROTOCOL_VERSION) |
54 | desc = SSL_AD_HANDSHAKE_FAILURE; /* SSL 3.0 does not have | |
55 | * protocol_version alerts */ | |
56 | if (desc < 0) | |
57 | return -1; | |
22d1138f DB |
58 | if (s->shutdown & SSL_SENT_SHUTDOWN && desc != SSL_AD_CLOSE_NOTIFY) |
59 | return -1; | |
c103c7e2 MC |
60 | /* If a fatal one, remove from cache */ |
61 | if ((level == SSL3_AL_FATAL) && (s->session != NULL)) | |
e2bb9b9b | 62 | SSL_CTX_remove_session(s->session_ctx, s->session); |
c103c7e2 | 63 | |
73243502 | 64 | s->s3.alert_dispatch = SSL_ALERT_DISPATCH_PENDING; |
555cbb32 TS |
65 | s->s3.send_alert[0] = level; |
66 | s->s3.send_alert[1] = desc; | |
f161995e | 67 | if (!RECORD_LAYER_write_pending(&s->rlayer)) { |
c103c7e2 | 68 | /* data still being written out? */ |
38b051a1 | 69 | return ssl->method->ssl_dispatch_alert(ssl); |
c103c7e2 MC |
70 | } |
71 | /* | |
72 | * else data is still being written out, we will get written some time in | |
73 | * the future | |
74 | */ | |
75 | return -1; | |
76 | } | |
77 | ||
78 | int ssl3_dispatch_alert(SSL *s) | |
79 | { | |
80 | int i, j; | |
81 | void (*cb) (const SSL *ssl, int type, int val) = NULL; | |
38b051a1 | 82 | SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s); |
a566864b | 83 | OSSL_RECORD_TEMPLATE templ; |
38b051a1 TM |
84 | |
85 | if (sc == NULL) | |
86 | return -1; | |
c103c7e2 | 87 | |
b5cf81f7 MC |
88 | if (sc->rlayer.wrlmethod == NULL) { |
89 | /* No write record layer so we can't sent and alert. We just ignore it */ | |
73243502 | 90 | sc->s3.alert_dispatch = SSL_ALERT_DISPATCH_NONE; |
b5cf81f7 MC |
91 | return 1; |
92 | } | |
93 | ||
a566864b | 94 | templ.type = SSL3_RT_ALERT; |
1d367677 MC |
95 | templ.version = (sc->version == TLS1_3_VERSION) ? TLS1_2_VERSION |
96 | : sc->version; | |
97 | if (SSL_get_state(s) == TLS_ST_CW_CLNT_HELLO | |
98 | && !sc->renegotiate | |
99 | && TLS1_get_version(s) > TLS1_VERSION | |
100 | && sc->hello_retry_request == SSL_HRR_NONE) { | |
101 | templ.version = TLS1_VERSION; | |
102 | } | |
a566864b MC |
103 | templ.buf = &sc->s3.send_alert[0]; |
104 | templ.buflen = 2; | |
105 | ||
73243502 MC |
106 | if (RECORD_LAYER_write_pending(&sc->rlayer)) { |
107 | if (sc->s3.alert_dispatch != SSL_ALERT_DISPATCH_RETRY) { | |
108 | /* | |
109 | * We have a write pending but it wasn't from a previous call to | |
110 | * this function! Can we ever get here? Maybe via API misuse?? | |
111 | * Give up. | |
112 | */ | |
113 | sc->s3.alert_dispatch = SSL_ALERT_DISPATCH_NONE; | |
114 | return -1; | |
115 | } | |
116 | /* Retry what we've already got pending */ | |
117 | i = HANDLE_RLAYER_WRITE_RETURN(sc, | |
118 | sc->rlayer.wrlmethod->retry_write_records(sc->rlayer.wrl)); | |
119 | if (i <= 0) { | |
120 | /* Could be NBIO. Keep alert_dispatch as SSL_ALERT_DISPATCH_RETRY */ | |
121 | return -1; | |
122 | } | |
123 | sc->rlayer.wpend_tot = 0; | |
124 | sc->s3.alert_dispatch = SSL_ALERT_DISPATCH_NONE; | |
125 | return 1; | |
126 | } | |
a566864b | 127 | |
320145d5 MC |
128 | i = HANDLE_RLAYER_WRITE_RETURN(sc, |
129 | sc->rlayer.wrlmethod->write_records(sc->rlayer.wrl, &templ, 1)); | |
73243502 | 130 | |
c103c7e2 | 131 | if (i <= 0) { |
73243502 MC |
132 | sc->s3.alert_dispatch = SSL_ALERT_DISPATCH_RETRY; |
133 | sc->rlayer.wpend_tot = templ.buflen; | |
134 | sc->rlayer.wpend_type = templ.type; | |
135 | sc->rlayer.wpend_buf = templ.buf; | |
c103c7e2 MC |
136 | } else { |
137 | /* | |
270d65fa TS |
138 | * Alert sent to BIO - now flush. If the message does not get sent due |
139 | * to non-blocking IO, we will not worry too much. | |
c103c7e2 | 140 | */ |
38b051a1 | 141 | (void)BIO_flush(sc->wbio); |
73243502 | 142 | sc->s3.alert_dispatch = SSL_ALERT_DISPATCH_NONE; |
c103c7e2 | 143 | |
38b051a1 TM |
144 | if (sc->msg_callback) |
145 | sc->msg_callback(1, sc->version, SSL3_RT_ALERT, sc->s3.send_alert, | |
146 | 2, s, sc->msg_callback_arg); | |
c103c7e2 | 147 | |
38b051a1 TM |
148 | if (sc->info_callback != NULL) |
149 | cb = sc->info_callback; | |
c103c7e2 MC |
150 | else if (s->ctx->info_callback != NULL) |
151 | cb = s->ctx->info_callback; | |
152 | ||
153 | if (cb != NULL) { | |
38b051a1 | 154 | j = (sc->s3.send_alert[0] << 8) | sc->s3.send_alert[1]; |
c103c7e2 MC |
155 | cb(s, SSL_CB_WRITE_ALERT, j); |
156 | } | |
157 | } | |
7ee8627f | 158 | return i; |
c103c7e2 | 159 | } |