2
0

statem.c 30 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966
  1. /*
  2. * Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the OpenSSL license (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include "internal/cryptlib.h"
  10. #include <openssl/rand.h>
  11. #include "../ssl_locl.h"
  12. #include "statem_locl.h"
  13. #include <assert.h>
  14. /*
  15. * This file implements the SSL/TLS/DTLS state machines.
  16. *
  17. * There are two primary state machines:
  18. *
  19. * 1) Message flow state machine
  20. * 2) Handshake state machine
  21. *
  22. * The Message flow state machine controls the reading and sending of messages
  23. * including handling of non-blocking IO events, flushing of the underlying
  24. * write BIO, handling unexpected messages, etc. It is itself broken into two
  25. * separate sub-state machines which control reading and writing respectively.
  26. *
  27. * The Handshake state machine keeps track of the current SSL/TLS handshake
  28. * state. Transitions of the handshake state are the result of events that
  29. * occur within the Message flow state machine.
  30. *
  31. * Overall it looks like this:
  32. *
  33. * --------------------------------------------- -------------------
  34. * | | | |
  35. * | Message flow state machine | | |
  36. * | | | |
  37. * | -------------------- -------------------- | Transition | Handshake state |
  38. * | | MSG_FLOW_READING | | MSG_FLOW_WRITING | | Event | machine |
  39. * | | sub-state | | sub-state | |----------->| |
  40. * | | machine for | | machine for | | | |
  41. * | | reading messages | | writing messages | | | |
  42. * | -------------------- -------------------- | | |
  43. * | | | |
  44. * --------------------------------------------- -------------------
  45. *
  46. */
  47. /* Sub state machine return values */
  48. typedef enum {
  49. /* Something bad happened or NBIO */
  50. SUB_STATE_ERROR,
  51. /* Sub state finished go to the next sub state */
  52. SUB_STATE_FINISHED,
  53. /* Sub state finished and handshake was completed */
  54. SUB_STATE_END_HANDSHAKE
  55. } SUB_STATE_RETURN;
  56. static int state_machine(SSL *s, int server);
  57. static void init_read_state_machine(SSL *s);
  58. static SUB_STATE_RETURN read_state_machine(SSL *s);
  59. static void init_write_state_machine(SSL *s);
  60. static SUB_STATE_RETURN write_state_machine(SSL *s);
  61. OSSL_HANDSHAKE_STATE SSL_get_state(const SSL *ssl)
  62. {
  63. return ssl->statem.hand_state;
  64. }
  65. int SSL_in_init(SSL *s)
  66. {
  67. return s->statem.in_init;
  68. }
  69. int SSL_is_init_finished(SSL *s)
  70. {
  71. return !(s->statem.in_init) && (s->statem.hand_state == TLS_ST_OK);
  72. }
  73. int SSL_in_before(SSL *s)
  74. {
  75. /*
  76. * Historically being "in before" meant before anything had happened. In the
  77. * current code though we remain in the "before" state for a while after we
  78. * have started the handshake process (e.g. as a server waiting for the
  79. * first message to arrive). There "in before" is taken to mean "in before"
  80. * and not started any handshake process yet.
  81. */
  82. return (s->statem.hand_state == TLS_ST_BEFORE)
  83. && (s->statem.state == MSG_FLOW_UNINITED);
  84. }
  85. /*
  86. * Clear the state machine state and reset back to MSG_FLOW_UNINITED
  87. */
  88. void ossl_statem_clear(SSL *s)
  89. {
  90. s->statem.state = MSG_FLOW_UNINITED;
  91. s->statem.hand_state = TLS_ST_BEFORE;
  92. s->statem.in_init = 1;
  93. s->statem.no_cert_verify = 0;
  94. }
  95. /*
  96. * Set the state machine up ready for a renegotiation handshake
  97. */
  98. void ossl_statem_set_renegotiate(SSL *s)
  99. {
  100. s->statem.in_init = 1;
  101. s->statem.request_state = TLS_ST_SW_HELLO_REQ;
  102. }
  103. /*
  104. * Put the state machine into an error state and send an alert if appropriate.
  105. * This is a permanent error for the current connection.
  106. */
  107. void ossl_statem_fatal(SSL *s, int al, int func, int reason, const char *file,
  108. int line)
  109. {
  110. /* We shouldn't call SSLfatal() twice. Once is enough */
  111. assert(s->statem.state != MSG_FLOW_ERROR);
  112. s->statem.in_init = 1;
  113. s->statem.state = MSG_FLOW_ERROR;
  114. ERR_put_error(ERR_LIB_SSL, func, reason, file, line);
  115. if (al != SSL_AD_NO_ALERT && !s->statem.invalid_enc_write_ctx)
  116. ssl3_send_alert(s, SSL3_AL_FATAL, al);
  117. }
  118. /*
  119. * This macro should only be called if we are already expecting to be in
  120. * a fatal error state. We verify that we are, and set it if not (this would
  121. * indicate a bug).
  122. */
  123. #define check_fatal(s, f) \
  124. do { \
  125. if (!ossl_assert((s)->statem.in_init \
  126. && (s)->statem.state == MSG_FLOW_ERROR)) \
  127. SSLfatal(s, SSL_AD_INTERNAL_ERROR, (f), \
  128. SSL_R_MISSING_FATAL); \
  129. } while (0)
  130. /*
  131. * Discover whether the current connection is in the error state.
  132. *
  133. * Valid return values are:
  134. * 1: Yes
  135. * 0: No
  136. */
  137. int ossl_statem_in_error(const SSL *s)
  138. {
  139. if (s->statem.state == MSG_FLOW_ERROR)
  140. return 1;
  141. return 0;
  142. }
  143. void ossl_statem_set_in_init(SSL *s, int init)
  144. {
  145. s->statem.in_init = init;
  146. }
  147. int ossl_statem_get_in_handshake(SSL *s)
  148. {
  149. return s->statem.in_handshake;
  150. }
  151. void ossl_statem_set_in_handshake(SSL *s, int inhand)
  152. {
  153. if (inhand)
  154. s->statem.in_handshake++;
  155. else
  156. s->statem.in_handshake--;
  157. }
  158. /* Are we in a sensible state to skip over unreadable early data? */
  159. int ossl_statem_skip_early_data(SSL *s)
  160. {
  161. if (s->ext.early_data != SSL_EARLY_DATA_REJECTED)
  162. return 0;
  163. if (!s->server || s->statem.hand_state != TLS_ST_EARLY_DATA)
  164. return 0;
  165. return 1;
  166. }
  167. /*
  168. * Called when we are in SSL_read*(), SSL_write*(), or SSL_accept()
  169. * /SSL_connect()/SSL_do_handshake(). Used to test whether we are in an early
  170. * data state and whether we should attempt to move the handshake on if so.
  171. * |sending| is 1 if we are attempting to send data (SSL_write*()), 0 if we are
  172. * attempting to read data (SSL_read*()), or -1 if we are in SSL_do_handshake()
  173. * or similar.
  174. */
  175. void ossl_statem_check_finish_init(SSL *s, int sending)
  176. {
  177. if (sending == -1) {
  178. if (s->statem.hand_state == TLS_ST_PENDING_EARLY_DATA_END
  179. || s->statem.hand_state == TLS_ST_EARLY_DATA) {
  180. ossl_statem_set_in_init(s, 1);
  181. if (s->early_data_state == SSL_EARLY_DATA_WRITE_RETRY) {
  182. /*
  183. * SSL_connect() or SSL_do_handshake() has been called directly.
  184. * We don't allow any more writing of early data.
  185. */
  186. s->early_data_state = SSL_EARLY_DATA_FINISHED_WRITING;
  187. }
  188. }
  189. } else if (!s->server) {
  190. if ((sending && (s->statem.hand_state == TLS_ST_PENDING_EARLY_DATA_END
  191. || s->statem.hand_state == TLS_ST_EARLY_DATA)
  192. && s->early_data_state != SSL_EARLY_DATA_WRITING)
  193. || (!sending && s->statem.hand_state == TLS_ST_EARLY_DATA)) {
  194. ossl_statem_set_in_init(s, 1);
  195. /*
  196. * SSL_write() has been called directly. We don't allow any more
  197. * writing of early data.
  198. */
  199. if (sending && s->early_data_state == SSL_EARLY_DATA_WRITE_RETRY)
  200. s->early_data_state = SSL_EARLY_DATA_FINISHED_WRITING;
  201. }
  202. } else {
  203. if (s->early_data_state == SSL_EARLY_DATA_FINISHED_READING
  204. && s->statem.hand_state == TLS_ST_EARLY_DATA)
  205. ossl_statem_set_in_init(s, 1);
  206. }
  207. }
  208. void ossl_statem_set_hello_verify_done(SSL *s)
  209. {
  210. s->statem.state = MSG_FLOW_UNINITED;
  211. s->statem.in_init = 1;
  212. /*
  213. * This will get reset (briefly) back to TLS_ST_BEFORE when we enter
  214. * state_machine() because |state| is MSG_FLOW_UNINITED, but until then any
  215. * calls to SSL_in_before() will return false. Also calls to
  216. * SSL_state_string() and SSL_state_string_long() will return something
  217. * sensible.
  218. */
  219. s->statem.hand_state = TLS_ST_SR_CLNT_HELLO;
  220. }
  221. int ossl_statem_connect(SSL *s)
  222. {
  223. return state_machine(s, 0);
  224. }
  225. int ossl_statem_accept(SSL *s)
  226. {
  227. return state_machine(s, 1);
  228. }
  229. typedef void (*info_cb) (const SSL *, int, int);
  230. static info_cb get_callback(SSL *s)
  231. {
  232. if (s->info_callback != NULL)
  233. return s->info_callback;
  234. else if (s->ctx->info_callback != NULL)
  235. return s->ctx->info_callback;
  236. return NULL;
  237. }
  238. /*
  239. * The main message flow state machine. We start in the MSG_FLOW_UNINITED or
  240. * MSG_FLOW_FINISHED state and finish in MSG_FLOW_FINISHED. Valid states and
  241. * transitions are as follows:
  242. *
  243. * MSG_FLOW_UNINITED MSG_FLOW_FINISHED
  244. * | |
  245. * +-----------------------+
  246. * v
  247. * MSG_FLOW_WRITING <---> MSG_FLOW_READING
  248. * |
  249. * V
  250. * MSG_FLOW_FINISHED
  251. * |
  252. * V
  253. * [SUCCESS]
  254. *
  255. * We may exit at any point due to an error or NBIO event. If an NBIO event
  256. * occurs then we restart at the point we left off when we are recalled.
  257. * MSG_FLOW_WRITING and MSG_FLOW_READING have sub-state machines associated with them.
  258. *
  259. * In addition to the above there is also the MSG_FLOW_ERROR state. We can move
  260. * into that state at any point in the event that an irrecoverable error occurs.
  261. *
  262. * Valid return values are:
  263. * 1: Success
  264. * <=0: NBIO or error
  265. */
  266. static int state_machine(SSL *s, int server)
  267. {
  268. BUF_MEM *buf = NULL;
  269. void (*cb) (const SSL *ssl, int type, int val) = NULL;
  270. OSSL_STATEM *st = &s->statem;
  271. int ret = -1;
  272. int ssret;
  273. if (st->state == MSG_FLOW_ERROR) {
  274. /* Shouldn't have been called if we're already in the error state */
  275. return -1;
  276. }
  277. ERR_clear_error();
  278. clear_sys_error();
  279. cb = get_callback(s);
  280. st->in_handshake++;
  281. if (!SSL_in_init(s) || SSL_in_before(s)) {
  282. /*
  283. * If we are stateless then we already called SSL_clear() - don't do
  284. * it again and clear the STATELESS flag itself.
  285. */
  286. if ((s->s3->flags & TLS1_FLAGS_STATELESS) == 0 && !SSL_clear(s))
  287. return -1;
  288. }
  289. #ifndef OPENSSL_NO_SCTP
  290. if (SSL_IS_DTLS(s) && BIO_dgram_is_sctp(SSL_get_wbio(s))) {
  291. /*
  292. * Notify SCTP BIO socket to enter handshake mode and prevent stream
  293. * identifier other than 0.
  294. */
  295. BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE,
  296. st->in_handshake, NULL);
  297. }
  298. #endif
  299. /* Initialise state machine */
  300. if (st->state == MSG_FLOW_UNINITED
  301. || st->state == MSG_FLOW_FINISHED) {
  302. if (st->state == MSG_FLOW_UNINITED) {
  303. st->hand_state = TLS_ST_BEFORE;
  304. st->request_state = TLS_ST_BEFORE;
  305. }
  306. s->server = server;
  307. if (cb != NULL)
  308. cb(s, SSL_CB_HANDSHAKE_START, 1);
  309. /*
  310. * Fatal errors in this block don't send an alert because we have
  311. * failed to even initialise properly. Sending an alert is probably
  312. * doomed to failure.
  313. */
  314. if (SSL_IS_DTLS(s)) {
  315. if ((s->version & 0xff00) != (DTLS1_VERSION & 0xff00) &&
  316. (server || (s->version & 0xff00) != (DTLS1_BAD_VER & 0xff00))) {
  317. SSLfatal(s, SSL_AD_NO_ALERT, SSL_F_STATE_MACHINE,
  318. ERR_R_INTERNAL_ERROR);
  319. goto end;
  320. }
  321. } else {
  322. if ((s->version >> 8) != SSL3_VERSION_MAJOR) {
  323. SSLfatal(s, SSL_AD_NO_ALERT, SSL_F_STATE_MACHINE,
  324. ERR_R_INTERNAL_ERROR);
  325. goto end;
  326. }
  327. }
  328. if (!ssl_security(s, SSL_SECOP_VERSION, 0, s->version, NULL)) {
  329. SSLfatal(s, SSL_AD_NO_ALERT, SSL_F_STATE_MACHINE,
  330. ERR_R_INTERNAL_ERROR);
  331. goto end;
  332. }
  333. if (s->init_buf == NULL) {
  334. if ((buf = BUF_MEM_new()) == NULL) {
  335. SSLfatal(s, SSL_AD_NO_ALERT, SSL_F_STATE_MACHINE,
  336. ERR_R_INTERNAL_ERROR);
  337. goto end;
  338. }
  339. if (!BUF_MEM_grow(buf, SSL3_RT_MAX_PLAIN_LENGTH)) {
  340. SSLfatal(s, SSL_AD_NO_ALERT, SSL_F_STATE_MACHINE,
  341. ERR_R_INTERNAL_ERROR);
  342. goto end;
  343. }
  344. s->init_buf = buf;
  345. buf = NULL;
  346. }
  347. if (!ssl3_setup_buffers(s)) {
  348. SSLfatal(s, SSL_AD_NO_ALERT, SSL_F_STATE_MACHINE,
  349. ERR_R_INTERNAL_ERROR);
  350. goto end;
  351. }
  352. s->init_num = 0;
  353. /*
  354. * Should have been reset by tls_process_finished, too.
  355. */
  356. s->s3->change_cipher_spec = 0;
  357. /*
  358. * Ok, we now need to push on a buffering BIO ...but not with
  359. * SCTP
  360. */
  361. #ifndef OPENSSL_NO_SCTP
  362. if (!SSL_IS_DTLS(s) || !BIO_dgram_is_sctp(SSL_get_wbio(s)))
  363. #endif
  364. if (!ssl_init_wbio_buffer(s)) {
  365. SSLfatal(s, SSL_AD_NO_ALERT, SSL_F_STATE_MACHINE,
  366. ERR_R_INTERNAL_ERROR);
  367. goto end;
  368. }
  369. if ((SSL_in_before(s))
  370. || s->renegotiate) {
  371. if (!tls_setup_handshake(s)) {
  372. /* SSLfatal() already called */
  373. goto end;
  374. }
  375. if (SSL_IS_FIRST_HANDSHAKE(s))
  376. st->read_state_first_init = 1;
  377. }
  378. st->state = MSG_FLOW_WRITING;
  379. init_write_state_machine(s);
  380. }
  381. while (st->state != MSG_FLOW_FINISHED) {
  382. if (st->state == MSG_FLOW_READING) {
  383. ssret = read_state_machine(s);
  384. if (ssret == SUB_STATE_FINISHED) {
  385. st->state = MSG_FLOW_WRITING;
  386. init_write_state_machine(s);
  387. } else {
  388. /* NBIO or error */
  389. goto end;
  390. }
  391. } else if (st->state == MSG_FLOW_WRITING) {
  392. ssret = write_state_machine(s);
  393. if (ssret == SUB_STATE_FINISHED) {
  394. st->state = MSG_FLOW_READING;
  395. init_read_state_machine(s);
  396. } else if (ssret == SUB_STATE_END_HANDSHAKE) {
  397. st->state = MSG_FLOW_FINISHED;
  398. } else {
  399. /* NBIO or error */
  400. goto end;
  401. }
  402. } else {
  403. /* Error */
  404. check_fatal(s, SSL_F_STATE_MACHINE);
  405. SSLerr(SSL_F_STATE_MACHINE, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
  406. goto end;
  407. }
  408. }
  409. ret = 1;
  410. end:
  411. st->in_handshake--;
  412. #ifndef OPENSSL_NO_SCTP
  413. if (SSL_IS_DTLS(s) && BIO_dgram_is_sctp(SSL_get_wbio(s))) {
  414. /*
  415. * Notify SCTP BIO socket to leave handshake mode and allow stream
  416. * identifier other than 0.
  417. */
  418. BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE,
  419. st->in_handshake, NULL);
  420. }
  421. #endif
  422. BUF_MEM_free(buf);
  423. if (cb != NULL) {
  424. if (server)
  425. cb(s, SSL_CB_ACCEPT_EXIT, ret);
  426. else
  427. cb(s, SSL_CB_CONNECT_EXIT, ret);
  428. }
  429. return ret;
  430. }
  431. /*
  432. * Initialise the MSG_FLOW_READING sub-state machine
  433. */
  434. static void init_read_state_machine(SSL *s)
  435. {
  436. OSSL_STATEM *st = &s->statem;
  437. st->read_state = READ_STATE_HEADER;
  438. }
  439. static int grow_init_buf(SSL *s, size_t size) {
  440. size_t msg_offset = (char *)s->init_msg - s->init_buf->data;
  441. if (!BUF_MEM_grow_clean(s->init_buf, (int)size))
  442. return 0;
  443. if (size < msg_offset)
  444. return 0;
  445. s->init_msg = s->init_buf->data + msg_offset;
  446. return 1;
  447. }
  448. /*
  449. * This function implements the sub-state machine when the message flow is in
  450. * MSG_FLOW_READING. The valid sub-states and transitions are:
  451. *
  452. * READ_STATE_HEADER <--+<-------------+
  453. * | | |
  454. * v | |
  455. * READ_STATE_BODY -----+-->READ_STATE_POST_PROCESS
  456. * | |
  457. * +----------------------------+
  458. * v
  459. * [SUB_STATE_FINISHED]
  460. *
  461. * READ_STATE_HEADER has the responsibility for reading in the message header
  462. * and transitioning the state of the handshake state machine.
  463. *
  464. * READ_STATE_BODY reads in the rest of the message and then subsequently
  465. * processes it.
  466. *
  467. * READ_STATE_POST_PROCESS is an optional step that may occur if some post
  468. * processing activity performed on the message may block.
  469. *
  470. * Any of the above states could result in an NBIO event occurring in which case
  471. * control returns to the calling application. When this function is recalled we
  472. * will resume in the same state where we left off.
  473. */
  474. static SUB_STATE_RETURN read_state_machine(SSL *s)
  475. {
  476. OSSL_STATEM *st = &s->statem;
  477. int ret, mt;
  478. size_t len = 0;
  479. int (*transition) (SSL *s, int mt);
  480. PACKET pkt;
  481. MSG_PROCESS_RETURN(*process_message) (SSL *s, PACKET *pkt);
  482. WORK_STATE(*post_process_message) (SSL *s, WORK_STATE wst);
  483. size_t (*max_message_size) (SSL *s);
  484. void (*cb) (const SSL *ssl, int type, int val) = NULL;
  485. cb = get_callback(s);
  486. if (s->server) {
  487. transition = ossl_statem_server_read_transition;
  488. process_message = ossl_statem_server_process_message;
  489. max_message_size = ossl_statem_server_max_message_size;
  490. post_process_message = ossl_statem_server_post_process_message;
  491. } else {
  492. transition = ossl_statem_client_read_transition;
  493. process_message = ossl_statem_client_process_message;
  494. max_message_size = ossl_statem_client_max_message_size;
  495. post_process_message = ossl_statem_client_post_process_message;
  496. }
  497. if (st->read_state_first_init) {
  498. s->first_packet = 1;
  499. st->read_state_first_init = 0;
  500. }
  501. while (1) {
  502. switch (st->read_state) {
  503. case READ_STATE_HEADER:
  504. /* Get the state the peer wants to move to */
  505. if (SSL_IS_DTLS(s)) {
  506. /*
  507. * In DTLS we get the whole message in one go - header and body
  508. */
  509. ret = dtls_get_message(s, &mt, &len);
  510. } else {
  511. ret = tls_get_message_header(s, &mt);
  512. }
  513. if (ret == 0) {
  514. /* Could be non-blocking IO */
  515. return SUB_STATE_ERROR;
  516. }
  517. if (cb != NULL) {
  518. /* Notify callback of an impending state change */
  519. if (s->server)
  520. cb(s, SSL_CB_ACCEPT_LOOP, 1);
  521. else
  522. cb(s, SSL_CB_CONNECT_LOOP, 1);
  523. }
  524. /*
  525. * Validate that we are allowed to move to the new state and move
  526. * to that state if so
  527. */
  528. if (!transition(s, mt))
  529. return SUB_STATE_ERROR;
  530. if (s->s3->tmp.message_size > max_message_size(s)) {
  531. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_READ_STATE_MACHINE,
  532. SSL_R_EXCESSIVE_MESSAGE_SIZE);
  533. return SUB_STATE_ERROR;
  534. }
  535. /* dtls_get_message already did this */
  536. if (!SSL_IS_DTLS(s)
  537. && s->s3->tmp.message_size > 0
  538. && !grow_init_buf(s, s->s3->tmp.message_size
  539. + SSL3_HM_HEADER_LENGTH)) {
  540. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_READ_STATE_MACHINE,
  541. ERR_R_BUF_LIB);
  542. return SUB_STATE_ERROR;
  543. }
  544. st->read_state = READ_STATE_BODY;
  545. /* Fall through */
  546. case READ_STATE_BODY:
  547. if (!SSL_IS_DTLS(s)) {
  548. /* We already got this above for DTLS */
  549. ret = tls_get_message_body(s, &len);
  550. if (ret == 0) {
  551. /* Could be non-blocking IO */
  552. return SUB_STATE_ERROR;
  553. }
  554. }
  555. s->first_packet = 0;
  556. if (!PACKET_buf_init(&pkt, s->init_msg, len)) {
  557. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_READ_STATE_MACHINE,
  558. ERR_R_INTERNAL_ERROR);
  559. return SUB_STATE_ERROR;
  560. }
  561. ret = process_message(s, &pkt);
  562. /* Discard the packet data */
  563. s->init_num = 0;
  564. switch (ret) {
  565. case MSG_PROCESS_ERROR:
  566. check_fatal(s, SSL_F_READ_STATE_MACHINE);
  567. return SUB_STATE_ERROR;
  568. case MSG_PROCESS_FINISHED_READING:
  569. if (SSL_IS_DTLS(s)) {
  570. dtls1_stop_timer(s);
  571. }
  572. return SUB_STATE_FINISHED;
  573. case MSG_PROCESS_CONTINUE_PROCESSING:
  574. st->read_state = READ_STATE_POST_PROCESS;
  575. st->read_state_work = WORK_MORE_A;
  576. break;
  577. default:
  578. st->read_state = READ_STATE_HEADER;
  579. break;
  580. }
  581. break;
  582. case READ_STATE_POST_PROCESS:
  583. st->read_state_work = post_process_message(s, st->read_state_work);
  584. switch (st->read_state_work) {
  585. case WORK_ERROR:
  586. check_fatal(s, SSL_F_READ_STATE_MACHINE);
  587. /* Fall through */
  588. case WORK_MORE_A:
  589. case WORK_MORE_B:
  590. case WORK_MORE_C:
  591. return SUB_STATE_ERROR;
  592. case WORK_FINISHED_CONTINUE:
  593. st->read_state = READ_STATE_HEADER;
  594. break;
  595. case WORK_FINISHED_STOP:
  596. if (SSL_IS_DTLS(s)) {
  597. dtls1_stop_timer(s);
  598. }
  599. return SUB_STATE_FINISHED;
  600. }
  601. break;
  602. default:
  603. /* Shouldn't happen */
  604. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_READ_STATE_MACHINE,
  605. ERR_R_INTERNAL_ERROR);
  606. return SUB_STATE_ERROR;
  607. }
  608. }
  609. }
  610. /*
  611. * Send a previously constructed message to the peer.
  612. */
  613. static int statem_do_write(SSL *s)
  614. {
  615. OSSL_STATEM *st = &s->statem;
  616. if (st->hand_state == TLS_ST_CW_CHANGE
  617. || st->hand_state == TLS_ST_SW_CHANGE) {
  618. if (SSL_IS_DTLS(s))
  619. return dtls1_do_write(s, SSL3_RT_CHANGE_CIPHER_SPEC);
  620. else
  621. return ssl3_do_write(s, SSL3_RT_CHANGE_CIPHER_SPEC);
  622. } else {
  623. return ssl_do_write(s);
  624. }
  625. }
  626. /*
  627. * Initialise the MSG_FLOW_WRITING sub-state machine
  628. */
  629. static void init_write_state_machine(SSL *s)
  630. {
  631. OSSL_STATEM *st = &s->statem;
  632. st->write_state = WRITE_STATE_TRANSITION;
  633. }
  634. /*
  635. * This function implements the sub-state machine when the message flow is in
  636. * MSG_FLOW_WRITING. The valid sub-states and transitions are:
  637. *
  638. * +-> WRITE_STATE_TRANSITION ------> [SUB_STATE_FINISHED]
  639. * | |
  640. * | v
  641. * | WRITE_STATE_PRE_WORK -----> [SUB_STATE_END_HANDSHAKE]
  642. * | |
  643. * | v
  644. * | WRITE_STATE_SEND
  645. * | |
  646. * | v
  647. * | WRITE_STATE_POST_WORK
  648. * | |
  649. * +-------------+
  650. *
  651. * WRITE_STATE_TRANSITION transitions the state of the handshake state machine
  652. * WRITE_STATE_PRE_WORK performs any work necessary to prepare the later
  653. * sending of the message. This could result in an NBIO event occurring in
  654. * which case control returns to the calling application. When this function
  655. * is recalled we will resume in the same state where we left off.
  656. *
  657. * WRITE_STATE_SEND sends the message and performs any work to be done after
  658. * sending.
  659. *
  660. * WRITE_STATE_POST_WORK performs any work necessary after the sending of the
  661. * message has been completed. As for WRITE_STATE_PRE_WORK this could also
  662. * result in an NBIO event.
  663. */
  664. static SUB_STATE_RETURN write_state_machine(SSL *s)
  665. {
  666. OSSL_STATEM *st = &s->statem;
  667. int ret;
  668. WRITE_TRAN(*transition) (SSL *s);
  669. WORK_STATE(*pre_work) (SSL *s, WORK_STATE wst);
  670. WORK_STATE(*post_work) (SSL *s, WORK_STATE wst);
  671. int (*get_construct_message_f) (SSL *s, WPACKET *pkt,
  672. int (**confunc) (SSL *s, WPACKET *pkt),
  673. int *mt);
  674. void (*cb) (const SSL *ssl, int type, int val) = NULL;
  675. int (*confunc) (SSL *s, WPACKET *pkt);
  676. int mt;
  677. WPACKET pkt;
  678. cb = get_callback(s);
  679. if (s->server) {
  680. transition = ossl_statem_server_write_transition;
  681. pre_work = ossl_statem_server_pre_work;
  682. post_work = ossl_statem_server_post_work;
  683. get_construct_message_f = ossl_statem_server_construct_message;
  684. } else {
  685. transition = ossl_statem_client_write_transition;
  686. pre_work = ossl_statem_client_pre_work;
  687. post_work = ossl_statem_client_post_work;
  688. get_construct_message_f = ossl_statem_client_construct_message;
  689. }
  690. while (1) {
  691. switch (st->write_state) {
  692. case WRITE_STATE_TRANSITION:
  693. if (cb != NULL) {
  694. /* Notify callback of an impending state change */
  695. if (s->server)
  696. cb(s, SSL_CB_ACCEPT_LOOP, 1);
  697. else
  698. cb(s, SSL_CB_CONNECT_LOOP, 1);
  699. }
  700. switch (transition(s)) {
  701. case WRITE_TRAN_CONTINUE:
  702. st->write_state = WRITE_STATE_PRE_WORK;
  703. st->write_state_work = WORK_MORE_A;
  704. break;
  705. case WRITE_TRAN_FINISHED:
  706. return SUB_STATE_FINISHED;
  707. break;
  708. case WRITE_TRAN_ERROR:
  709. check_fatal(s, SSL_F_WRITE_STATE_MACHINE);
  710. return SUB_STATE_ERROR;
  711. }
  712. break;
  713. case WRITE_STATE_PRE_WORK:
  714. switch (st->write_state_work = pre_work(s, st->write_state_work)) {
  715. case WORK_ERROR:
  716. check_fatal(s, SSL_F_WRITE_STATE_MACHINE);
  717. /* Fall through */
  718. case WORK_MORE_A:
  719. case WORK_MORE_B:
  720. case WORK_MORE_C:
  721. return SUB_STATE_ERROR;
  722. case WORK_FINISHED_CONTINUE:
  723. st->write_state = WRITE_STATE_SEND;
  724. break;
  725. case WORK_FINISHED_STOP:
  726. return SUB_STATE_END_HANDSHAKE;
  727. }
  728. if (!get_construct_message_f(s, &pkt, &confunc, &mt)) {
  729. /* SSLfatal() already called */
  730. return SUB_STATE_ERROR;
  731. }
  732. if (mt == SSL3_MT_DUMMY) {
  733. /* Skip construction and sending. This isn't a "real" state */
  734. st->write_state = WRITE_STATE_POST_WORK;
  735. st->write_state_work = WORK_MORE_A;
  736. break;
  737. }
  738. if (!WPACKET_init(&pkt, s->init_buf)
  739. || !ssl_set_handshake_header(s, &pkt, mt)) {
  740. WPACKET_cleanup(&pkt);
  741. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_WRITE_STATE_MACHINE,
  742. ERR_R_INTERNAL_ERROR);
  743. return SUB_STATE_ERROR;
  744. }
  745. if (confunc != NULL && !confunc(s, &pkt)) {
  746. WPACKET_cleanup(&pkt);
  747. check_fatal(s, SSL_F_WRITE_STATE_MACHINE);
  748. return SUB_STATE_ERROR;
  749. }
  750. if (!ssl_close_construct_packet(s, &pkt, mt)
  751. || !WPACKET_finish(&pkt)) {
  752. WPACKET_cleanup(&pkt);
  753. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_WRITE_STATE_MACHINE,
  754. ERR_R_INTERNAL_ERROR);
  755. return SUB_STATE_ERROR;
  756. }
  757. /* Fall through */
  758. case WRITE_STATE_SEND:
  759. if (SSL_IS_DTLS(s) && st->use_timer) {
  760. dtls1_start_timer(s);
  761. }
  762. ret = statem_do_write(s);
  763. if (ret <= 0) {
  764. return SUB_STATE_ERROR;
  765. }
  766. st->write_state = WRITE_STATE_POST_WORK;
  767. st->write_state_work = WORK_MORE_A;
  768. /* Fall through */
  769. case WRITE_STATE_POST_WORK:
  770. switch (st->write_state_work = post_work(s, st->write_state_work)) {
  771. case WORK_ERROR:
  772. check_fatal(s, SSL_F_WRITE_STATE_MACHINE);
  773. /* Fall through */
  774. case WORK_MORE_A:
  775. case WORK_MORE_B:
  776. case WORK_MORE_C:
  777. return SUB_STATE_ERROR;
  778. case WORK_FINISHED_CONTINUE:
  779. st->write_state = WRITE_STATE_TRANSITION;
  780. break;
  781. case WORK_FINISHED_STOP:
  782. return SUB_STATE_END_HANDSHAKE;
  783. }
  784. break;
  785. default:
  786. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_WRITE_STATE_MACHINE,
  787. ERR_R_INTERNAL_ERROR);
  788. return SUB_STATE_ERROR;
  789. }
  790. }
  791. }
  792. /*
  793. * Flush the write BIO
  794. */
  795. int statem_flush(SSL *s)
  796. {
  797. s->rwstate = SSL_WRITING;
  798. if (BIO_flush(s->wbio) <= 0) {
  799. return 0;
  800. }
  801. s->rwstate = SSL_NOTHING;
  802. return 1;
  803. }
  804. /*
  805. * Called by the record layer to determine whether application data is
  806. * allowed to be received in the current handshake state or not.
  807. *
  808. * Return values are:
  809. * 1: Yes (application data allowed)
  810. * 0: No (application data not allowed)
  811. */
  812. int ossl_statem_app_data_allowed(SSL *s)
  813. {
  814. OSSL_STATEM *st = &s->statem;
  815. if (st->state == MSG_FLOW_UNINITED)
  816. return 0;
  817. if (!s->s3->in_read_app_data || (s->s3->total_renegotiations == 0))
  818. return 0;
  819. if (s->server) {
  820. /*
  821. * If we're a server and we haven't got as far as writing our
  822. * ServerHello yet then we allow app data
  823. */
  824. if (st->hand_state == TLS_ST_BEFORE
  825. || st->hand_state == TLS_ST_SR_CLNT_HELLO)
  826. return 1;
  827. } else {
  828. /*
  829. * If we're a client and we haven't read the ServerHello yet then we
  830. * allow app data
  831. */
  832. if (st->hand_state == TLS_ST_CW_CLNT_HELLO)
  833. return 1;
  834. }
  835. return 0;
  836. }
  837. /*
  838. * This function returns 1 if TLS exporter is ready to export keying
  839. * material, or 0 if otherwise.
  840. */
  841. int ossl_statem_export_allowed(SSL *s)
  842. {
  843. return s->s3->previous_server_finished_len != 0
  844. && s->statem.hand_state != TLS_ST_SW_FINISHED;
  845. }
  846. /*
  847. * Return 1 if early TLS exporter is ready to export keying material,
  848. * or 0 if otherwise.
  849. */
  850. int ossl_statem_export_early_allowed(SSL *s)
  851. {
  852. /*
  853. * The early exporter secret is only present on the server if we
  854. * have accepted early_data. It is present on the client as long
  855. * as we have sent early_data.
  856. */
  857. return s->ext.early_data == SSL_EARLY_DATA_ACCEPTED
  858. || (!s->server && s->ext.early_data != SSL_EARLY_DATA_NOT_SENT);
  859. }