statem.c 32 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032
  1. /*
  2. * Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #if defined(__TANDEM) && defined(_SPT_MODEL_)
  10. # include <spthread.h>
  11. # include <spt_extensions.h> /* timeval */
  12. #endif
  13. #include "internal/cryptlib.h"
  14. #include <openssl/rand.h>
  15. #include "../ssl_local.h"
  16. #include "statem_local.h"
  17. #include <assert.h>
  18. /*
  19. * This file implements the SSL/TLS/DTLS state machines.
  20. *
  21. * There are two primary state machines:
  22. *
  23. * 1) Message flow state machine
  24. * 2) Handshake state machine
  25. *
  26. * The Message flow state machine controls the reading and sending of messages
  27. * including handling of non-blocking IO events, flushing of the underlying
  28. * write BIO, handling unexpected messages, etc. It is itself broken into two
  29. * separate sub-state machines which control reading and writing respectively.
  30. *
  31. * The Handshake state machine keeps track of the current SSL/TLS handshake
  32. * state. Transitions of the handshake state are the result of events that
  33. * occur within the Message flow state machine.
  34. *
  35. * Overall it looks like this:
  36. *
  37. * --------------------------------------------- -------------------
  38. * | | | |
  39. * | Message flow state machine | | |
  40. * | | | |
  41. * | -------------------- -------------------- | Transition | Handshake state |
  42. * | | MSG_FLOW_READING | | MSG_FLOW_WRITING | | Event | machine |
  43. * | | sub-state | | sub-state | |----------->| |
  44. * | | machine for | | machine for | | | |
  45. * | | reading messages | | writing messages | | | |
  46. * | -------------------- -------------------- | | |
  47. * | | | |
  48. * --------------------------------------------- -------------------
  49. *
  50. */
  51. /* Sub state machine return values */
  52. typedef enum {
  53. /* Something bad happened or NBIO */
  54. SUB_STATE_ERROR,
  55. /* Sub state finished go to the next sub state */
  56. SUB_STATE_FINISHED,
  57. /* Sub state finished and handshake was completed */
  58. SUB_STATE_END_HANDSHAKE
  59. } SUB_STATE_RETURN;
  60. static int state_machine(SSL_CONNECTION *s, int server);
  61. static void init_read_state_machine(SSL_CONNECTION *s);
  62. static SUB_STATE_RETURN read_state_machine(SSL_CONNECTION *s);
  63. static void init_write_state_machine(SSL_CONNECTION *s);
  64. static SUB_STATE_RETURN write_state_machine(SSL_CONNECTION *s);
  65. OSSL_HANDSHAKE_STATE SSL_get_state(const SSL *ssl)
  66. {
  67. const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(ssl);
  68. if (sc == NULL)
  69. return TLS_ST_BEFORE;
  70. return sc->statem.hand_state;
  71. }
  72. int SSL_in_init(const SSL *s)
  73. {
  74. const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
  75. if (sc == NULL)
  76. return 0;
  77. return sc->statem.in_init;
  78. }
  79. int SSL_is_init_finished(const SSL *s)
  80. {
  81. const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
  82. if (sc == NULL)
  83. return 0;
  84. return !(sc->statem.in_init) && (sc->statem.hand_state == TLS_ST_OK);
  85. }
  86. int SSL_in_before(const SSL *s)
  87. {
  88. const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
  89. if (sc == NULL)
  90. return 0;
  91. /*
  92. * Historically being "in before" meant before anything had happened. In the
  93. * current code though we remain in the "before" state for a while after we
  94. * have started the handshake process (e.g. as a server waiting for the
  95. * first message to arrive). There "in before" is taken to mean "in before"
  96. * and not started any handshake process yet.
  97. */
  98. return (sc->statem.hand_state == TLS_ST_BEFORE)
  99. && (sc->statem.state == MSG_FLOW_UNINITED);
  100. }
  101. OSSL_HANDSHAKE_STATE ossl_statem_get_state(SSL_CONNECTION *s)
  102. {
  103. return s != NULL ? s->statem.hand_state : TLS_ST_BEFORE;
  104. }
  105. /*
  106. * Clear the state machine state and reset back to MSG_FLOW_UNINITED
  107. */
  108. void ossl_statem_clear(SSL_CONNECTION *s)
  109. {
  110. s->statem.state = MSG_FLOW_UNINITED;
  111. s->statem.hand_state = TLS_ST_BEFORE;
  112. ossl_statem_set_in_init(s, 1);
  113. s->statem.no_cert_verify = 0;
  114. }
  115. /*
  116. * Set the state machine up ready for a renegotiation handshake
  117. */
  118. void ossl_statem_set_renegotiate(SSL_CONNECTION *s)
  119. {
  120. ossl_statem_set_in_init(s, 1);
  121. s->statem.request_state = TLS_ST_SW_HELLO_REQ;
  122. }
  123. void ossl_statem_send_fatal(SSL_CONNECTION *s, int al)
  124. {
  125. /* We shouldn't call SSLfatal() twice. Once is enough */
  126. if (s->statem.in_init && s->statem.state == MSG_FLOW_ERROR)
  127. return;
  128. ossl_statem_set_in_init(s, 1);
  129. s->statem.state = MSG_FLOW_ERROR;
  130. if (al != SSL_AD_NO_ALERT)
  131. ssl3_send_alert(s, SSL3_AL_FATAL, al);
  132. }
  133. /*
  134. * Error reporting building block that's used instead of ERR_set_error().
  135. * In addition to what ERR_set_error() does, this puts the state machine
  136. * into an error state and sends an alert if appropriate.
  137. * This is a permanent error for the current connection.
  138. */
  139. void ossl_statem_fatal(SSL_CONNECTION *s, int al, int reason,
  140. const char *fmt, ...)
  141. {
  142. va_list args;
  143. va_start(args, fmt);
  144. ERR_vset_error(ERR_LIB_SSL, reason, fmt, args);
  145. va_end(args);
  146. ossl_statem_send_fatal(s, al);
  147. }
  148. /*
  149. * This macro should only be called if we are already expecting to be in
  150. * a fatal error state. We verify that we are, and set it if not (this would
  151. * indicate a bug).
  152. */
  153. #define check_fatal(s) \
  154. do { \
  155. if (!ossl_assert((s)->statem.in_init \
  156. && (s)->statem.state == MSG_FLOW_ERROR)) \
  157. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_MISSING_FATAL); \
  158. } while (0)
  159. /*
  160. * Discover whether the current connection is in the error state.
  161. *
  162. * Valid return values are:
  163. * 1: Yes
  164. * 0: No
  165. */
  166. int ossl_statem_in_error(const SSL_CONNECTION *s)
  167. {
  168. if (s->statem.state == MSG_FLOW_ERROR)
  169. return 1;
  170. return 0;
  171. }
  172. void ossl_statem_set_in_init(SSL_CONNECTION *s, int init)
  173. {
  174. s->statem.in_init = init;
  175. if (s->rlayer.rrlmethod != NULL && s->rlayer.rrlmethod->set_in_init != NULL)
  176. s->rlayer.rrlmethod->set_in_init(s->rlayer.rrl, init);
  177. }
  178. int ossl_statem_get_in_handshake(SSL_CONNECTION *s)
  179. {
  180. return s->statem.in_handshake;
  181. }
  182. void ossl_statem_set_in_handshake(SSL_CONNECTION *s, int inhand)
  183. {
  184. if (inhand)
  185. s->statem.in_handshake++;
  186. else
  187. s->statem.in_handshake--;
  188. }
  189. /* Are we in a sensible state to skip over unreadable early data? */
  190. int ossl_statem_skip_early_data(SSL_CONNECTION *s)
  191. {
  192. if (s->ext.early_data != SSL_EARLY_DATA_REJECTED)
  193. return 0;
  194. if (!s->server
  195. || s->statem.hand_state != TLS_ST_EARLY_DATA
  196. || s->hello_retry_request == SSL_HRR_COMPLETE)
  197. return 0;
  198. return 1;
  199. }
  200. /*
  201. * Called when we are in SSL_read*(), SSL_write*(), or SSL_accept()
  202. * /SSL_connect()/SSL_do_handshake(). Used to test whether we are in an early
  203. * data state and whether we should attempt to move the handshake on if so.
  204. * |sending| is 1 if we are attempting to send data (SSL_write*()), 0 if we are
  205. * attempting to read data (SSL_read*()), or -1 if we are in SSL_do_handshake()
  206. * or similar.
  207. */
  208. void ossl_statem_check_finish_init(SSL_CONNECTION *s, int sending)
  209. {
  210. if (sending == -1) {
  211. if (s->statem.hand_state == TLS_ST_PENDING_EARLY_DATA_END
  212. || s->statem.hand_state == TLS_ST_EARLY_DATA) {
  213. ossl_statem_set_in_init(s, 1);
  214. if (s->early_data_state == SSL_EARLY_DATA_WRITE_RETRY) {
  215. /*
  216. * SSL_connect() or SSL_do_handshake() has been called directly.
  217. * We don't allow any more writing of early data.
  218. */
  219. s->early_data_state = SSL_EARLY_DATA_FINISHED_WRITING;
  220. }
  221. }
  222. } else if (!s->server) {
  223. if ((sending && (s->statem.hand_state == TLS_ST_PENDING_EARLY_DATA_END
  224. || s->statem.hand_state == TLS_ST_EARLY_DATA)
  225. && s->early_data_state != SSL_EARLY_DATA_WRITING)
  226. || (!sending && s->statem.hand_state == TLS_ST_EARLY_DATA)) {
  227. ossl_statem_set_in_init(s, 1);
  228. /*
  229. * SSL_write() has been called directly. We don't allow any more
  230. * writing of early data.
  231. */
  232. if (sending && s->early_data_state == SSL_EARLY_DATA_WRITE_RETRY)
  233. s->early_data_state = SSL_EARLY_DATA_FINISHED_WRITING;
  234. }
  235. } else {
  236. if (s->early_data_state == SSL_EARLY_DATA_FINISHED_READING
  237. && s->statem.hand_state == TLS_ST_EARLY_DATA)
  238. ossl_statem_set_in_init(s, 1);
  239. }
  240. }
  241. void ossl_statem_set_hello_verify_done(SSL_CONNECTION *s)
  242. {
  243. s->statem.state = MSG_FLOW_UNINITED;
  244. ossl_statem_set_in_init(s, 1);
  245. /*
  246. * This will get reset (briefly) back to TLS_ST_BEFORE when we enter
  247. * state_machine() because |state| is MSG_FLOW_UNINITED, but until then any
  248. * calls to SSL_in_before() will return false. Also calls to
  249. * SSL_state_string() and SSL_state_string_long() will return something
  250. * sensible.
  251. */
  252. s->statem.hand_state = TLS_ST_SR_CLNT_HELLO;
  253. }
  254. int ossl_statem_connect(SSL *s)
  255. {
  256. SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
  257. if (sc == NULL)
  258. return -1;
  259. return state_machine(sc, 0);
  260. }
  261. int ossl_statem_accept(SSL *s)
  262. {
  263. SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
  264. if (sc == NULL)
  265. return -1;
  266. return state_machine(sc, 1);
  267. }
  268. typedef void (*info_cb) (const SSL *, int, int);
  269. static info_cb get_callback(SSL_CONNECTION *s)
  270. {
  271. SSL_CTX *sctx = SSL_CONNECTION_GET_CTX(s);
  272. if (s->info_callback != NULL)
  273. return s->info_callback;
  274. else if (sctx->info_callback != NULL)
  275. return sctx->info_callback;
  276. return NULL;
  277. }
  278. /*
  279. * The main message flow state machine. We start in the MSG_FLOW_UNINITED or
  280. * MSG_FLOW_FINISHED state and finish in MSG_FLOW_FINISHED. Valid states and
  281. * transitions are as follows:
  282. *
  283. * MSG_FLOW_UNINITED MSG_FLOW_FINISHED
  284. * | |
  285. * +-----------------------+
  286. * v
  287. * MSG_FLOW_WRITING <---> MSG_FLOW_READING
  288. * |
  289. * V
  290. * MSG_FLOW_FINISHED
  291. * |
  292. * V
  293. * [SUCCESS]
  294. *
  295. * We may exit at any point due to an error or NBIO event. If an NBIO event
  296. * occurs then we restart at the point we left off when we are recalled.
  297. * MSG_FLOW_WRITING and MSG_FLOW_READING have sub-state machines associated with them.
  298. *
  299. * In addition to the above there is also the MSG_FLOW_ERROR state. We can move
  300. * into that state at any point in the event that an irrecoverable error occurs.
  301. *
  302. * Valid return values are:
  303. * 1: Success
  304. * <=0: NBIO or error
  305. */
  306. static int state_machine(SSL_CONNECTION *s, int server)
  307. {
  308. BUF_MEM *buf = NULL;
  309. void (*cb) (const SSL *ssl, int type, int val) = NULL;
  310. OSSL_STATEM *st = &s->statem;
  311. int ret = -1;
  312. int ssret;
  313. SSL *ssl = SSL_CONNECTION_GET_SSL(s);
  314. if (st->state == MSG_FLOW_ERROR) {
  315. /* Shouldn't have been called if we're already in the error state */
  316. return -1;
  317. }
  318. ERR_clear_error();
  319. clear_sys_error();
  320. cb = get_callback(s);
  321. st->in_handshake++;
  322. if (!SSL_in_init(ssl) || SSL_in_before(ssl)) {
  323. /*
  324. * If we are stateless then we already called SSL_clear() - don't do
  325. * it again and clear the STATELESS flag itself.
  326. */
  327. if ((s->s3.flags & TLS1_FLAGS_STATELESS) == 0 && !SSL_clear(ssl))
  328. return -1;
  329. }
  330. #ifndef OPENSSL_NO_SCTP
  331. if (SSL_CONNECTION_IS_DTLS(s) && BIO_dgram_is_sctp(SSL_get_wbio(ssl))) {
  332. /*
  333. * Notify SCTP BIO socket to enter handshake mode and prevent stream
  334. * identifier other than 0.
  335. */
  336. BIO_ctrl(SSL_get_wbio(ssl), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE,
  337. st->in_handshake, NULL);
  338. }
  339. #endif
  340. /* Initialise state machine */
  341. if (st->state == MSG_FLOW_UNINITED
  342. || st->state == MSG_FLOW_FINISHED) {
  343. if (st->state == MSG_FLOW_UNINITED) {
  344. st->hand_state = TLS_ST_BEFORE;
  345. st->request_state = TLS_ST_BEFORE;
  346. }
  347. s->server = server;
  348. if (cb != NULL) {
  349. if (SSL_IS_FIRST_HANDSHAKE(s) || !SSL_CONNECTION_IS_TLS13(s))
  350. cb(ssl, SSL_CB_HANDSHAKE_START, 1);
  351. }
  352. /*
  353. * Fatal errors in this block don't send an alert because we have
  354. * failed to even initialise properly. Sending an alert is probably
  355. * doomed to failure.
  356. */
  357. if (SSL_CONNECTION_IS_DTLS(s)) {
  358. if ((s->version & 0xff00) != (DTLS1_VERSION & 0xff00) &&
  359. (server || (s->version & 0xff00) != (DTLS1_BAD_VER & 0xff00))) {
  360. SSLfatal(s, SSL_AD_NO_ALERT, ERR_R_INTERNAL_ERROR);
  361. goto end;
  362. }
  363. } else {
  364. if ((s->version >> 8) != SSL3_VERSION_MAJOR) {
  365. SSLfatal(s, SSL_AD_NO_ALERT, ERR_R_INTERNAL_ERROR);
  366. goto end;
  367. }
  368. }
  369. if (!ssl_security(s, SSL_SECOP_VERSION, 0, s->version, NULL)) {
  370. SSLfatal(s, SSL_AD_NO_ALERT, ERR_R_INTERNAL_ERROR);
  371. goto end;
  372. }
  373. if (s->init_buf == NULL) {
  374. if ((buf = BUF_MEM_new()) == NULL) {
  375. SSLfatal(s, SSL_AD_NO_ALERT, ERR_R_INTERNAL_ERROR);
  376. goto end;
  377. }
  378. if (!BUF_MEM_grow(buf, SSL3_RT_MAX_PLAIN_LENGTH)) {
  379. SSLfatal(s, SSL_AD_NO_ALERT, ERR_R_INTERNAL_ERROR);
  380. goto end;
  381. }
  382. s->init_buf = buf;
  383. buf = NULL;
  384. }
  385. s->init_num = 0;
  386. /*
  387. * Should have been reset by tls_process_finished, too.
  388. */
  389. s->s3.change_cipher_spec = 0;
  390. /*
  391. * Ok, we now need to push on a buffering BIO ...but not with
  392. * SCTP
  393. */
  394. #ifndef OPENSSL_NO_SCTP
  395. if (!SSL_CONNECTION_IS_DTLS(s) || !BIO_dgram_is_sctp(SSL_get_wbio(ssl)))
  396. #endif
  397. if (!ssl_init_wbio_buffer(s)) {
  398. SSLfatal(s, SSL_AD_NO_ALERT, ERR_R_INTERNAL_ERROR);
  399. goto end;
  400. }
  401. if ((SSL_in_before(ssl))
  402. || s->renegotiate) {
  403. if (!tls_setup_handshake(s)) {
  404. /* SSLfatal() already called */
  405. goto end;
  406. }
  407. if (SSL_IS_FIRST_HANDSHAKE(s))
  408. st->read_state_first_init = 1;
  409. }
  410. st->state = MSG_FLOW_WRITING;
  411. init_write_state_machine(s);
  412. }
  413. while (st->state != MSG_FLOW_FINISHED) {
  414. if (st->state == MSG_FLOW_READING) {
  415. ssret = read_state_machine(s);
  416. if (ssret == SUB_STATE_FINISHED) {
  417. st->state = MSG_FLOW_WRITING;
  418. init_write_state_machine(s);
  419. } else {
  420. /* NBIO or error */
  421. goto end;
  422. }
  423. } else if (st->state == MSG_FLOW_WRITING) {
  424. ssret = write_state_machine(s);
  425. if (ssret == SUB_STATE_FINISHED) {
  426. st->state = MSG_FLOW_READING;
  427. init_read_state_machine(s);
  428. } else if (ssret == SUB_STATE_END_HANDSHAKE) {
  429. st->state = MSG_FLOW_FINISHED;
  430. } else {
  431. /* NBIO or error */
  432. goto end;
  433. }
  434. } else {
  435. /* Error */
  436. check_fatal(s);
  437. ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
  438. goto end;
  439. }
  440. }
  441. ret = 1;
  442. end:
  443. st->in_handshake--;
  444. #ifndef OPENSSL_NO_SCTP
  445. if (SSL_CONNECTION_IS_DTLS(s) && BIO_dgram_is_sctp(SSL_get_wbio(ssl))) {
  446. /*
  447. * Notify SCTP BIO socket to leave handshake mode and allow stream
  448. * identifier other than 0.
  449. */
  450. BIO_ctrl(SSL_get_wbio(ssl), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE,
  451. st->in_handshake, NULL);
  452. }
  453. #endif
  454. BUF_MEM_free(buf);
  455. if (cb != NULL) {
  456. if (server)
  457. cb(ssl, SSL_CB_ACCEPT_EXIT, ret);
  458. else
  459. cb(ssl, SSL_CB_CONNECT_EXIT, ret);
  460. }
  461. return ret;
  462. }
  463. /*
  464. * Initialise the MSG_FLOW_READING sub-state machine
  465. */
  466. static void init_read_state_machine(SSL_CONNECTION *s)
  467. {
  468. OSSL_STATEM *st = &s->statem;
  469. st->read_state = READ_STATE_HEADER;
  470. }
  471. static int grow_init_buf(SSL_CONNECTION *s, size_t size) {
  472. size_t msg_offset = (char *)s->init_msg - s->init_buf->data;
  473. if (!BUF_MEM_grow_clean(s->init_buf, (int)size))
  474. return 0;
  475. if (size < msg_offset)
  476. return 0;
  477. s->init_msg = s->init_buf->data + msg_offset;
  478. return 1;
  479. }
  480. /*
  481. * This function implements the sub-state machine when the message flow is in
  482. * MSG_FLOW_READING. The valid sub-states and transitions are:
  483. *
  484. * READ_STATE_HEADER <--+<-------------+
  485. * | | |
  486. * v | |
  487. * READ_STATE_BODY -----+-->READ_STATE_POST_PROCESS
  488. * | |
  489. * +----------------------------+
  490. * v
  491. * [SUB_STATE_FINISHED]
  492. *
  493. * READ_STATE_HEADER has the responsibility for reading in the message header
  494. * and transitioning the state of the handshake state machine.
  495. *
  496. * READ_STATE_BODY reads in the rest of the message and then subsequently
  497. * processes it.
  498. *
  499. * READ_STATE_POST_PROCESS is an optional step that may occur if some post
  500. * processing activity performed on the message may block.
  501. *
  502. * Any of the above states could result in an NBIO event occurring in which case
  503. * control returns to the calling application. When this function is recalled we
  504. * will resume in the same state where we left off.
  505. */
  506. static SUB_STATE_RETURN read_state_machine(SSL_CONNECTION *s)
  507. {
  508. OSSL_STATEM *st = &s->statem;
  509. int ret, mt;
  510. size_t len = 0;
  511. int (*transition) (SSL_CONNECTION *s, int mt);
  512. PACKET pkt;
  513. MSG_PROCESS_RETURN(*process_message) (SSL_CONNECTION *s, PACKET *pkt);
  514. WORK_STATE(*post_process_message) (SSL_CONNECTION *s, WORK_STATE wst);
  515. size_t (*max_message_size) (SSL_CONNECTION *s);
  516. void (*cb) (const SSL *ssl, int type, int val) = NULL;
  517. SSL *ssl = SSL_CONNECTION_GET_SSL(s);
  518. cb = get_callback(s);
  519. if (s->server) {
  520. transition = ossl_statem_server_read_transition;
  521. process_message = ossl_statem_server_process_message;
  522. max_message_size = ossl_statem_server_max_message_size;
  523. post_process_message = ossl_statem_server_post_process_message;
  524. } else {
  525. transition = ossl_statem_client_read_transition;
  526. process_message = ossl_statem_client_process_message;
  527. max_message_size = ossl_statem_client_max_message_size;
  528. post_process_message = ossl_statem_client_post_process_message;
  529. }
  530. if (st->read_state_first_init) {
  531. s->first_packet = 1;
  532. st->read_state_first_init = 0;
  533. }
  534. while (1) {
  535. switch (st->read_state) {
  536. case READ_STATE_HEADER:
  537. /* Get the state the peer wants to move to */
  538. if (SSL_CONNECTION_IS_DTLS(s)) {
  539. /*
  540. * In DTLS we get the whole message in one go - header and body
  541. */
  542. ret = dtls_get_message(s, &mt);
  543. } else {
  544. ret = tls_get_message_header(s, &mt);
  545. }
  546. if (ret == 0) {
  547. /* Could be non-blocking IO */
  548. return SUB_STATE_ERROR;
  549. }
  550. if (cb != NULL) {
  551. /* Notify callback of an impending state change */
  552. if (s->server)
  553. cb(ssl, SSL_CB_ACCEPT_LOOP, 1);
  554. else
  555. cb(ssl, SSL_CB_CONNECT_LOOP, 1);
  556. }
  557. /*
  558. * Validate that we are allowed to move to the new state and move
  559. * to that state if so
  560. */
  561. if (!transition(s, mt))
  562. return SUB_STATE_ERROR;
  563. if (s->s3.tmp.message_size > max_message_size(s)) {
  564. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
  565. SSL_R_EXCESSIVE_MESSAGE_SIZE);
  566. return SUB_STATE_ERROR;
  567. }
  568. /* dtls_get_message already did this */
  569. if (!SSL_CONNECTION_IS_DTLS(s)
  570. && s->s3.tmp.message_size > 0
  571. && !grow_init_buf(s, s->s3.tmp.message_size
  572. + SSL3_HM_HEADER_LENGTH)) {
  573. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_BUF_LIB);
  574. return SUB_STATE_ERROR;
  575. }
  576. st->read_state = READ_STATE_BODY;
  577. /* Fall through */
  578. case READ_STATE_BODY:
  579. if (SSL_CONNECTION_IS_DTLS(s)) {
  580. /*
  581. * Actually we already have the body, but we give DTLS the
  582. * opportunity to do any further processing.
  583. */
  584. ret = dtls_get_message_body(s, &len);
  585. } else {
  586. ret = tls_get_message_body(s, &len);
  587. }
  588. if (ret == 0) {
  589. /* Could be non-blocking IO */
  590. return SUB_STATE_ERROR;
  591. }
  592. s->first_packet = 0;
  593. if (!PACKET_buf_init(&pkt, s->init_msg, len)) {
  594. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  595. return SUB_STATE_ERROR;
  596. }
  597. ret = process_message(s, &pkt);
  598. /* Discard the packet data */
  599. s->init_num = 0;
  600. switch (ret) {
  601. case MSG_PROCESS_ERROR:
  602. check_fatal(s);
  603. return SUB_STATE_ERROR;
  604. case MSG_PROCESS_FINISHED_READING:
  605. if (SSL_CONNECTION_IS_DTLS(s)) {
  606. dtls1_stop_timer(s);
  607. }
  608. return SUB_STATE_FINISHED;
  609. case MSG_PROCESS_CONTINUE_PROCESSING:
  610. st->read_state = READ_STATE_POST_PROCESS;
  611. st->read_state_work = WORK_MORE_A;
  612. break;
  613. default:
  614. st->read_state = READ_STATE_HEADER;
  615. break;
  616. }
  617. break;
  618. case READ_STATE_POST_PROCESS:
  619. st->read_state_work = post_process_message(s, st->read_state_work);
  620. switch (st->read_state_work) {
  621. case WORK_ERROR:
  622. check_fatal(s);
  623. /* Fall through */
  624. case WORK_MORE_A:
  625. case WORK_MORE_B:
  626. case WORK_MORE_C:
  627. return SUB_STATE_ERROR;
  628. case WORK_FINISHED_CONTINUE:
  629. st->read_state = READ_STATE_HEADER;
  630. break;
  631. case WORK_FINISHED_STOP:
  632. if (SSL_CONNECTION_IS_DTLS(s)) {
  633. dtls1_stop_timer(s);
  634. }
  635. return SUB_STATE_FINISHED;
  636. }
  637. break;
  638. default:
  639. /* Shouldn't happen */
  640. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  641. return SUB_STATE_ERROR;
  642. }
  643. }
  644. }
  645. /*
  646. * Send a previously constructed message to the peer.
  647. */
  648. static int statem_do_write(SSL_CONNECTION *s)
  649. {
  650. OSSL_STATEM *st = &s->statem;
  651. if (st->hand_state == TLS_ST_CW_CHANGE
  652. || st->hand_state == TLS_ST_SW_CHANGE) {
  653. if (SSL_CONNECTION_IS_DTLS(s))
  654. return dtls1_do_write(s, SSL3_RT_CHANGE_CIPHER_SPEC);
  655. else
  656. return ssl3_do_write(s, SSL3_RT_CHANGE_CIPHER_SPEC);
  657. } else {
  658. return ssl_do_write(s);
  659. }
  660. }
  661. /*
  662. * Initialise the MSG_FLOW_WRITING sub-state machine
  663. */
  664. static void init_write_state_machine(SSL_CONNECTION *s)
  665. {
  666. OSSL_STATEM *st = &s->statem;
  667. st->write_state = WRITE_STATE_TRANSITION;
  668. }
  669. /*
  670. * This function implements the sub-state machine when the message flow is in
  671. * MSG_FLOW_WRITING. The valid sub-states and transitions are:
  672. *
  673. * +-> WRITE_STATE_TRANSITION ------> [SUB_STATE_FINISHED]
  674. * | |
  675. * | v
  676. * | WRITE_STATE_PRE_WORK -----> [SUB_STATE_END_HANDSHAKE]
  677. * | |
  678. * | v
  679. * | WRITE_STATE_SEND
  680. * | |
  681. * | v
  682. * | WRITE_STATE_POST_WORK
  683. * | |
  684. * +-------------+
  685. *
  686. * WRITE_STATE_TRANSITION transitions the state of the handshake state machine
  687. * WRITE_STATE_PRE_WORK performs any work necessary to prepare the later
  688. * sending of the message. This could result in an NBIO event occurring in
  689. * which case control returns to the calling application. When this function
  690. * is recalled we will resume in the same state where we left off.
  691. *
  692. * WRITE_STATE_SEND sends the message and performs any work to be done after
  693. * sending.
  694. *
  695. * WRITE_STATE_POST_WORK performs any work necessary after the sending of the
  696. * message has been completed. As for WRITE_STATE_PRE_WORK this could also
  697. * result in an NBIO event.
  698. */
  699. static SUB_STATE_RETURN write_state_machine(SSL_CONNECTION *s)
  700. {
  701. OSSL_STATEM *st = &s->statem;
  702. int ret;
  703. WRITE_TRAN(*transition) (SSL_CONNECTION *s);
  704. WORK_STATE(*pre_work) (SSL_CONNECTION *s, WORK_STATE wst);
  705. WORK_STATE(*post_work) (SSL_CONNECTION *s, WORK_STATE wst);
  706. int (*get_construct_message_f) (SSL_CONNECTION *s,
  707. CON_FUNC_RETURN (**confunc) (SSL_CONNECTION *s,
  708. WPACKET *pkt),
  709. int *mt);
  710. void (*cb) (const SSL *ssl, int type, int val) = NULL;
  711. CON_FUNC_RETURN (*confunc) (SSL_CONNECTION *s, WPACKET *pkt);
  712. int mt;
  713. WPACKET pkt;
  714. SSL *ssl = SSL_CONNECTION_GET_SSL(s);
  715. cb = get_callback(s);
  716. if (s->server) {
  717. transition = ossl_statem_server_write_transition;
  718. pre_work = ossl_statem_server_pre_work;
  719. post_work = ossl_statem_server_post_work;
  720. get_construct_message_f = ossl_statem_server_construct_message;
  721. } else {
  722. transition = ossl_statem_client_write_transition;
  723. pre_work = ossl_statem_client_pre_work;
  724. post_work = ossl_statem_client_post_work;
  725. get_construct_message_f = ossl_statem_client_construct_message;
  726. }
  727. while (1) {
  728. switch (st->write_state) {
  729. case WRITE_STATE_TRANSITION:
  730. if (cb != NULL) {
  731. /* Notify callback of an impending state change */
  732. if (s->server)
  733. cb(ssl, SSL_CB_ACCEPT_LOOP, 1);
  734. else
  735. cb(ssl, SSL_CB_CONNECT_LOOP, 1);
  736. }
  737. switch (transition(s)) {
  738. case WRITE_TRAN_CONTINUE:
  739. st->write_state = WRITE_STATE_PRE_WORK;
  740. st->write_state_work = WORK_MORE_A;
  741. break;
  742. case WRITE_TRAN_FINISHED:
  743. return SUB_STATE_FINISHED;
  744. break;
  745. case WRITE_TRAN_ERROR:
  746. check_fatal(s);
  747. return SUB_STATE_ERROR;
  748. }
  749. break;
  750. case WRITE_STATE_PRE_WORK:
  751. switch (st->write_state_work = pre_work(s, st->write_state_work)) {
  752. case WORK_ERROR:
  753. check_fatal(s);
  754. /* Fall through */
  755. case WORK_MORE_A:
  756. case WORK_MORE_B:
  757. case WORK_MORE_C:
  758. return SUB_STATE_ERROR;
  759. case WORK_FINISHED_CONTINUE:
  760. st->write_state = WRITE_STATE_SEND;
  761. break;
  762. case WORK_FINISHED_STOP:
  763. return SUB_STATE_END_HANDSHAKE;
  764. }
  765. if (!get_construct_message_f(s, &confunc, &mt)) {
  766. /* SSLfatal() already called */
  767. return SUB_STATE_ERROR;
  768. }
  769. if (mt == SSL3_MT_DUMMY) {
  770. /* Skip construction and sending. This isn't a "real" state */
  771. st->write_state = WRITE_STATE_POST_WORK;
  772. st->write_state_work = WORK_MORE_A;
  773. break;
  774. }
  775. if (!WPACKET_init(&pkt, s->init_buf)
  776. || !ssl_set_handshake_header(s, &pkt, mt)) {
  777. WPACKET_cleanup(&pkt);
  778. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  779. return SUB_STATE_ERROR;
  780. }
  781. if (confunc != NULL) {
  782. CON_FUNC_RETURN tmpret;
  783. tmpret = confunc(s, &pkt);
  784. if (tmpret == CON_FUNC_ERROR) {
  785. WPACKET_cleanup(&pkt);
  786. check_fatal(s);
  787. return SUB_STATE_ERROR;
  788. } else if (tmpret == CON_FUNC_DONT_SEND) {
  789. /*
  790. * The construction function decided not to construct the
  791. * message after all and continue. Skip sending.
  792. */
  793. WPACKET_cleanup(&pkt);
  794. st->write_state = WRITE_STATE_POST_WORK;
  795. st->write_state_work = WORK_MORE_A;
  796. break;
  797. } /* else success */
  798. }
  799. if (!ssl_close_construct_packet(s, &pkt, mt)
  800. || !WPACKET_finish(&pkt)) {
  801. WPACKET_cleanup(&pkt);
  802. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  803. return SUB_STATE_ERROR;
  804. }
  805. /* Fall through */
  806. case WRITE_STATE_SEND:
  807. if (SSL_CONNECTION_IS_DTLS(s) && st->use_timer) {
  808. dtls1_start_timer(s);
  809. }
  810. ret = statem_do_write(s);
  811. if (ret <= 0) {
  812. return SUB_STATE_ERROR;
  813. }
  814. st->write_state = WRITE_STATE_POST_WORK;
  815. st->write_state_work = WORK_MORE_A;
  816. /* Fall through */
  817. case WRITE_STATE_POST_WORK:
  818. switch (st->write_state_work = post_work(s, st->write_state_work)) {
  819. case WORK_ERROR:
  820. check_fatal(s);
  821. /* Fall through */
  822. case WORK_MORE_A:
  823. case WORK_MORE_B:
  824. case WORK_MORE_C:
  825. return SUB_STATE_ERROR;
  826. case WORK_FINISHED_CONTINUE:
  827. st->write_state = WRITE_STATE_TRANSITION;
  828. break;
  829. case WORK_FINISHED_STOP:
  830. return SUB_STATE_END_HANDSHAKE;
  831. }
  832. break;
  833. default:
  834. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  835. return SUB_STATE_ERROR;
  836. }
  837. }
  838. }
  839. /*
  840. * Flush the write BIO
  841. */
  842. int statem_flush(SSL_CONNECTION *s)
  843. {
  844. s->rwstate = SSL_WRITING;
  845. if (BIO_flush(s->wbio) <= 0) {
  846. return 0;
  847. }
  848. s->rwstate = SSL_NOTHING;
  849. return 1;
  850. }
  851. /*
  852. * Called by the record layer to determine whether application data is
  853. * allowed to be received in the current handshake state or not.
  854. *
  855. * Return values are:
  856. * 1: Yes (application data allowed)
  857. * 0: No (application data not allowed)
  858. */
  859. int ossl_statem_app_data_allowed(SSL_CONNECTION *s)
  860. {
  861. OSSL_STATEM *st = &s->statem;
  862. if (st->state == MSG_FLOW_UNINITED)
  863. return 0;
  864. if (!s->s3.in_read_app_data || (s->s3.total_renegotiations == 0))
  865. return 0;
  866. if (s->server) {
  867. /*
  868. * If we're a server and we haven't got as far as writing our
  869. * ServerHello yet then we allow app data
  870. */
  871. if (st->hand_state == TLS_ST_BEFORE
  872. || st->hand_state == TLS_ST_SR_CLNT_HELLO)
  873. return 1;
  874. } else {
  875. /*
  876. * If we're a client and we haven't read the ServerHello yet then we
  877. * allow app data
  878. */
  879. if (st->hand_state == TLS_ST_CW_CLNT_HELLO)
  880. return 1;
  881. }
  882. return 0;
  883. }
  884. /*
  885. * This function returns 1 if TLS exporter is ready to export keying
  886. * material, or 0 if otherwise.
  887. */
  888. int ossl_statem_export_allowed(SSL_CONNECTION *s)
  889. {
  890. return s->s3.previous_server_finished_len != 0
  891. && s->statem.hand_state != TLS_ST_SW_FINISHED;
  892. }
  893. /*
  894. * Return 1 if early TLS exporter is ready to export keying material,
  895. * or 0 if otherwise.
  896. */
  897. int ossl_statem_export_early_allowed(SSL_CONNECTION *s)
  898. {
  899. /*
  900. * The early exporter secret is only present on the server if we
  901. * have accepted early_data. It is present on the client as long
  902. * as we have sent early_data.
  903. */
  904. return s->ext.early_data == SSL_EARLY_DATA_ACCEPTED
  905. || (!s->server && s->ext.early_data != SSL_EARLY_DATA_NOT_SENT);
  906. }