statem_dtls.c 43 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358
  1. /*
  2. * Copyright 2005-2023 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <assert.h>
  10. #include <limits.h>
  11. #include <string.h>
  12. #include <stdio.h>
  13. #include "../ssl_local.h"
  14. #include "statem_local.h"
  15. #include "internal/cryptlib.h"
  16. #include <openssl/buffer.h>
  17. #include <openssl/objects.h>
  18. #include <openssl/evp.h>
  19. #include <openssl/x509.h>
  20. #define RSMBLY_BITMASK_SIZE(msg_len) (((msg_len) + 7) / 8)
  21. #define RSMBLY_BITMASK_MARK(bitmask, start, end) { \
  22. if ((end) - (start) <= 8) { \
  23. long ii; \
  24. for (ii = (start); ii < (end); ii++) bitmask[((ii) >> 3)] |= (1 << ((ii) & 7)); \
  25. } else { \
  26. long ii; \
  27. bitmask[((start) >> 3)] |= bitmask_start_values[((start) & 7)]; \
  28. for (ii = (((start) >> 3) + 1); ii < ((((end) - 1)) >> 3); ii++) bitmask[ii] = 0xff; \
  29. bitmask[(((end) - 1) >> 3)] |= bitmask_end_values[((end) & 7)]; \
  30. } }
  31. #define RSMBLY_BITMASK_IS_COMPLETE(bitmask, msg_len, is_complete) { \
  32. long ii; \
  33. is_complete = 1; \
  34. if (bitmask[(((msg_len) - 1) >> 3)] != bitmask_end_values[((msg_len) & 7)]) is_complete = 0; \
  35. if (is_complete) for (ii = (((msg_len) - 1) >> 3) - 1; ii >= 0 ; ii--) \
  36. if (bitmask[ii] != 0xff) { is_complete = 0; break; } }
  37. static unsigned char bitmask_start_values[] =
  38. { 0xff, 0xfe, 0xfc, 0xf8, 0xf0, 0xe0, 0xc0, 0x80 };
  39. static unsigned char bitmask_end_values[] =
  40. { 0xff, 0x01, 0x03, 0x07, 0x0f, 0x1f, 0x3f, 0x7f };
  41. static void dtls1_fix_message_header(SSL_CONNECTION *s, size_t frag_off,
  42. size_t frag_len);
  43. static unsigned char *dtls1_write_message_header(SSL_CONNECTION *s,
  44. unsigned char *p);
  45. static void dtls1_set_message_header_int(SSL_CONNECTION *s, unsigned char mt,
  46. size_t len,
  47. unsigned short seq_num,
  48. size_t frag_off,
  49. size_t frag_len);
  50. static int dtls_get_reassembled_message(SSL_CONNECTION *s, int *errtype,
  51. size_t *len);
  52. static hm_fragment *dtls1_hm_fragment_new(size_t frag_len, int reassembly)
  53. {
  54. hm_fragment *frag = NULL;
  55. unsigned char *buf = NULL;
  56. unsigned char *bitmask = NULL;
  57. if ((frag = OPENSSL_zalloc(sizeof(*frag))) == NULL)
  58. return NULL;
  59. if (frag_len) {
  60. if ((buf = OPENSSL_malloc(frag_len)) == NULL) {
  61. OPENSSL_free(frag);
  62. return NULL;
  63. }
  64. }
  65. /* zero length fragment gets zero frag->fragment */
  66. frag->fragment = buf;
  67. /* Initialize reassembly bitmask if necessary */
  68. if (reassembly) {
  69. bitmask = OPENSSL_zalloc(RSMBLY_BITMASK_SIZE(frag_len));
  70. if (bitmask == NULL) {
  71. OPENSSL_free(buf);
  72. OPENSSL_free(frag);
  73. return NULL;
  74. }
  75. }
  76. frag->reassembly = bitmask;
  77. return frag;
  78. }
  79. void dtls1_hm_fragment_free(hm_fragment *frag)
  80. {
  81. if (!frag)
  82. return;
  83. OPENSSL_free(frag->fragment);
  84. OPENSSL_free(frag->reassembly);
  85. OPENSSL_free(frag);
  86. }
  87. /*
  88. * send s->init_buf in records of type 'type' (SSL3_RT_HANDSHAKE or
  89. * SSL3_RT_CHANGE_CIPHER_SPEC)
  90. */
  91. int dtls1_do_write(SSL_CONNECTION *s, uint8_t type)
  92. {
  93. int ret;
  94. size_t written;
  95. size_t curr_mtu;
  96. int retry = 1;
  97. size_t len, frag_off, overhead, used_len;
  98. SSL *ssl = SSL_CONNECTION_GET_SSL(s);
  99. if (!dtls1_query_mtu(s))
  100. return -1;
  101. if (s->d1->mtu < dtls1_min_mtu(s))
  102. /* should have something reasonable now */
  103. return -1;
  104. if (s->init_off == 0 && type == SSL3_RT_HANDSHAKE) {
  105. if (!ossl_assert(s->init_num ==
  106. s->d1->w_msg_hdr.msg_len + DTLS1_HM_HEADER_LENGTH))
  107. return -1;
  108. }
  109. overhead = s->rlayer.wrlmethod->get_max_record_overhead(s->rlayer.wrl);
  110. frag_off = 0;
  111. s->rwstate = SSL_NOTHING;
  112. /* s->init_num shouldn't ever be < 0...but just in case */
  113. while (s->init_num > 0) {
  114. if (type == SSL3_RT_HANDSHAKE && s->init_off != 0) {
  115. /* We must be writing a fragment other than the first one */
  116. if (frag_off > 0) {
  117. /* This is the first attempt at writing out this fragment */
  118. if (s->init_off <= DTLS1_HM_HEADER_LENGTH) {
  119. /*
  120. * Each fragment that was already sent must at least have
  121. * contained the message header plus one other byte.
  122. * Therefore |init_off| must have progressed by at least
  123. * |DTLS1_HM_HEADER_LENGTH + 1| bytes. If not something went
  124. * wrong.
  125. */
  126. return -1;
  127. }
  128. /*
  129. * Adjust |init_off| and |init_num| to allow room for a new
  130. * message header for this fragment.
  131. */
  132. s->init_off -= DTLS1_HM_HEADER_LENGTH;
  133. s->init_num += DTLS1_HM_HEADER_LENGTH;
  134. } else {
  135. /*
  136. * We must have been called again after a retry so use the
  137. * fragment offset from our last attempt. We do not need
  138. * to adjust |init_off| and |init_num| as above, because
  139. * that should already have been done before the retry.
  140. */
  141. frag_off = s->d1->w_msg_hdr.frag_off;
  142. }
  143. }
  144. used_len = BIO_wpending(s->wbio) + overhead;
  145. if (s->d1->mtu > used_len)
  146. curr_mtu = s->d1->mtu - used_len;
  147. else
  148. curr_mtu = 0;
  149. if (curr_mtu <= DTLS1_HM_HEADER_LENGTH) {
  150. /*
  151. * grr.. we could get an error if MTU picked was wrong
  152. */
  153. ret = BIO_flush(s->wbio);
  154. if (ret <= 0) {
  155. s->rwstate = SSL_WRITING;
  156. return ret;
  157. }
  158. if (s->d1->mtu > overhead + DTLS1_HM_HEADER_LENGTH) {
  159. curr_mtu = s->d1->mtu - overhead;
  160. } else {
  161. /* Shouldn't happen */
  162. return -1;
  163. }
  164. }
  165. /*
  166. * We just checked that s->init_num > 0 so this cast should be safe
  167. */
  168. if (((unsigned int)s->init_num) > curr_mtu)
  169. len = curr_mtu;
  170. else
  171. len = s->init_num;
  172. if (len > ssl_get_max_send_fragment(s))
  173. len = ssl_get_max_send_fragment(s);
  174. /*
  175. * XDTLS: this function is too long. split out the CCS part
  176. */
  177. if (type == SSL3_RT_HANDSHAKE) {
  178. if (len < DTLS1_HM_HEADER_LENGTH) {
  179. /*
  180. * len is so small that we really can't do anything sensible
  181. * so fail
  182. */
  183. return -1;
  184. }
  185. dtls1_fix_message_header(s, frag_off, len - DTLS1_HM_HEADER_LENGTH);
  186. dtls1_write_message_header(s,
  187. (unsigned char *)&s->init_buf->
  188. data[s->init_off]);
  189. }
  190. ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off], len,
  191. &written);
  192. if (ret <= 0) {
  193. /*
  194. * might need to update MTU here, but we don't know which
  195. * previous packet caused the failure -- so can't really
  196. * retransmit anything. continue as if everything is fine and
  197. * wait for an alert to handle the retransmit
  198. */
  199. if (retry && BIO_ctrl(SSL_get_wbio(ssl),
  200. BIO_CTRL_DGRAM_MTU_EXCEEDED, 0, NULL) > 0) {
  201. if (!(SSL_get_options(ssl) & SSL_OP_NO_QUERY_MTU)) {
  202. if (!dtls1_query_mtu(s))
  203. return -1;
  204. /* Have one more go */
  205. retry = 0;
  206. } else
  207. return -1;
  208. } else {
  209. return -1;
  210. }
  211. } else {
  212. /*
  213. * bad if this assert fails, only part of the handshake message
  214. * got sent. but why would this happen?
  215. */
  216. if (!ossl_assert(len == written))
  217. return -1;
  218. /*
  219. * We should not exceed the MTU size. If compression is in use
  220. * then the max record overhead calculation is unreliable so we do
  221. * not check in that case. We use assert rather than ossl_assert
  222. * because in a production build, if this assert were ever to fail,
  223. * then the best thing to do is probably carry on regardless.
  224. */
  225. assert(s->s3.tmp.new_compression != NULL
  226. || BIO_wpending(s->wbio) <= (int)s->d1->mtu);
  227. if (type == SSL3_RT_HANDSHAKE && !s->d1->retransmitting) {
  228. /*
  229. * should not be done for 'Hello Request's, but in that case
  230. * we'll ignore the result anyway
  231. */
  232. unsigned char *p =
  233. (unsigned char *)&s->init_buf->data[s->init_off];
  234. const struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr;
  235. size_t xlen;
  236. if (frag_off == 0 && s->version != DTLS1_BAD_VER) {
  237. /*
  238. * reconstruct message header is if it is being sent in
  239. * single fragment
  240. */
  241. *p++ = msg_hdr->type;
  242. l2n3(msg_hdr->msg_len, p);
  243. s2n(msg_hdr->seq, p);
  244. l2n3(0, p);
  245. l2n3(msg_hdr->msg_len, p);
  246. p -= DTLS1_HM_HEADER_LENGTH;
  247. xlen = written;
  248. } else {
  249. p += DTLS1_HM_HEADER_LENGTH;
  250. xlen = written - DTLS1_HM_HEADER_LENGTH;
  251. }
  252. if (!ssl3_finish_mac(s, p, xlen))
  253. return -1;
  254. }
  255. if (written == s->init_num) {
  256. if (s->msg_callback)
  257. s->msg_callback(1, s->version, type, s->init_buf->data,
  258. (size_t)(s->init_off + s->init_num), ssl,
  259. s->msg_callback_arg);
  260. s->init_off = 0; /* done writing this message */
  261. s->init_num = 0;
  262. return 1;
  263. }
  264. s->init_off += written;
  265. s->init_num -= written;
  266. written -= DTLS1_HM_HEADER_LENGTH;
  267. frag_off += written;
  268. /*
  269. * We save the fragment offset for the next fragment so we have it
  270. * available in case of an IO retry. We don't know the length of the
  271. * next fragment yet so just set that to 0 for now. It will be
  272. * updated again later.
  273. */
  274. dtls1_fix_message_header(s, frag_off, 0);
  275. }
  276. }
  277. return 0;
  278. }
  279. int dtls_get_message(SSL_CONNECTION *s, int *mt)
  280. {
  281. struct hm_header_st *msg_hdr;
  282. unsigned char *p;
  283. size_t msg_len;
  284. size_t tmplen;
  285. int errtype;
  286. msg_hdr = &s->d1->r_msg_hdr;
  287. memset(msg_hdr, 0, sizeof(*msg_hdr));
  288. again:
  289. if (!dtls_get_reassembled_message(s, &errtype, &tmplen)) {
  290. if (errtype == DTLS1_HM_BAD_FRAGMENT
  291. || errtype == DTLS1_HM_FRAGMENT_RETRY) {
  292. /* bad fragment received */
  293. goto again;
  294. }
  295. return 0;
  296. }
  297. *mt = s->s3.tmp.message_type;
  298. p = (unsigned char *)s->init_buf->data;
  299. if (*mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
  300. if (s->msg_callback) {
  301. s->msg_callback(0, s->version, SSL3_RT_CHANGE_CIPHER_SPEC,
  302. p, 1, SSL_CONNECTION_GET_SSL(s),
  303. s->msg_callback_arg);
  304. }
  305. /*
  306. * This isn't a real handshake message so skip the processing below.
  307. */
  308. return 1;
  309. }
  310. msg_len = msg_hdr->msg_len;
  311. /* reconstruct message header */
  312. *(p++) = msg_hdr->type;
  313. l2n3(msg_len, p);
  314. s2n(msg_hdr->seq, p);
  315. l2n3(0, p);
  316. l2n3(msg_len, p);
  317. memset(msg_hdr, 0, sizeof(*msg_hdr));
  318. s->d1->handshake_read_seq++;
  319. s->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH;
  320. return 1;
  321. }
  322. /*
  323. * Actually we already have the message body - but this is an opportunity for
  324. * DTLS to do any further processing it wants at the same point that TLS would
  325. * be asked for the message body.
  326. */
  327. int dtls_get_message_body(SSL_CONNECTION *s, size_t *len)
  328. {
  329. unsigned char *msg = (unsigned char *)s->init_buf->data;
  330. size_t msg_len = s->init_num + DTLS1_HM_HEADER_LENGTH;
  331. if (s->s3.tmp.message_type == SSL3_MT_CHANGE_CIPHER_SPEC) {
  332. /* Nothing to be done */
  333. goto end;
  334. }
  335. /*
  336. * If receiving Finished, record MAC of prior handshake messages for
  337. * Finished verification.
  338. */
  339. if (*(s->init_buf->data) == SSL3_MT_FINISHED && !ssl3_take_mac(s)) {
  340. /* SSLfatal() already called */
  341. return 0;
  342. }
  343. if (s->version == DTLS1_BAD_VER) {
  344. msg += DTLS1_HM_HEADER_LENGTH;
  345. msg_len -= DTLS1_HM_HEADER_LENGTH;
  346. }
  347. if (!ssl3_finish_mac(s, msg, msg_len))
  348. return 0;
  349. if (s->msg_callback)
  350. s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,
  351. s->init_buf->data, s->init_num + DTLS1_HM_HEADER_LENGTH,
  352. SSL_CONNECTION_GET_SSL(s), s->msg_callback_arg);
  353. end:
  354. *len = s->init_num;
  355. return 1;
  356. }
  357. /*
  358. * dtls1_max_handshake_message_len returns the maximum number of bytes
  359. * permitted in a DTLS handshake message for |s|. The minimum is 16KB, but
  360. * may be greater if the maximum certificate list size requires it.
  361. */
  362. static size_t dtls1_max_handshake_message_len(const SSL_CONNECTION *s)
  363. {
  364. size_t max_len = DTLS1_HM_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH;
  365. if (max_len < s->max_cert_list)
  366. return s->max_cert_list;
  367. return max_len;
  368. }
  369. static int dtls1_preprocess_fragment(SSL_CONNECTION *s,
  370. struct hm_header_st *msg_hdr)
  371. {
  372. size_t frag_off, frag_len, msg_len;
  373. msg_len = msg_hdr->msg_len;
  374. frag_off = msg_hdr->frag_off;
  375. frag_len = msg_hdr->frag_len;
  376. /* sanity checking */
  377. if ((frag_off + frag_len) > msg_len
  378. || msg_len > dtls1_max_handshake_message_len(s)) {
  379. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_EXCESSIVE_MESSAGE_SIZE);
  380. return 0;
  381. }
  382. if (s->d1->r_msg_hdr.frag_off == 0) { /* first fragment */
  383. /*
  384. * msg_len is limited to 2^24, but is effectively checked against
  385. * dtls_max_handshake_message_len(s) above
  386. */
  387. if (!BUF_MEM_grow_clean(s->init_buf, msg_len + DTLS1_HM_HEADER_LENGTH)) {
  388. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_BUF_LIB);
  389. return 0;
  390. }
  391. s->s3.tmp.message_size = msg_len;
  392. s->d1->r_msg_hdr.msg_len = msg_len;
  393. s->s3.tmp.message_type = msg_hdr->type;
  394. s->d1->r_msg_hdr.type = msg_hdr->type;
  395. s->d1->r_msg_hdr.seq = msg_hdr->seq;
  396. } else if (msg_len != s->d1->r_msg_hdr.msg_len) {
  397. /*
  398. * They must be playing with us! BTW, failure to enforce upper limit
  399. * would open possibility for buffer overrun.
  400. */
  401. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_EXCESSIVE_MESSAGE_SIZE);
  402. return 0;
  403. }
  404. return 1;
  405. }
  406. /*
  407. * Returns 1 if there is a buffered fragment available, 0 if not, or -1 on a
  408. * fatal error.
  409. */
  410. static int dtls1_retrieve_buffered_fragment(SSL_CONNECTION *s, size_t *len)
  411. {
  412. /*-
  413. * (0) check whether the desired fragment is available
  414. * if so:
  415. * (1) copy over the fragment to s->init_buf->data[]
  416. * (2) update s->init_num
  417. */
  418. pitem *item;
  419. piterator iter;
  420. hm_fragment *frag;
  421. int ret;
  422. int chretran = 0;
  423. iter = pqueue_iterator(s->d1->buffered_messages);
  424. do {
  425. item = pqueue_next(&iter);
  426. if (item == NULL)
  427. return 0;
  428. frag = (hm_fragment *)item->data;
  429. if (frag->msg_header.seq < s->d1->handshake_read_seq) {
  430. pitem *next;
  431. hm_fragment *nextfrag;
  432. if (!s->server
  433. || frag->msg_header.seq != 0
  434. || s->d1->handshake_read_seq != 1
  435. || s->statem.hand_state != DTLS_ST_SW_HELLO_VERIFY_REQUEST) {
  436. /*
  437. * This is a stale message that has been buffered so clear it.
  438. * It is safe to pop this message from the queue even though
  439. * we have an active iterator
  440. */
  441. pqueue_pop(s->d1->buffered_messages);
  442. dtls1_hm_fragment_free(frag);
  443. pitem_free(item);
  444. item = NULL;
  445. frag = NULL;
  446. } else {
  447. /*
  448. * We have fragments for a ClientHello without a cookie,
  449. * even though we have sent a HelloVerifyRequest. It is possible
  450. * that the HelloVerifyRequest got lost and this is a
  451. * retransmission of the original ClientHello
  452. */
  453. next = pqueue_next(&iter);
  454. if (next != NULL) {
  455. nextfrag = (hm_fragment *)next->data;
  456. if (nextfrag->msg_header.seq == s->d1->handshake_read_seq) {
  457. /*
  458. * We have fragments for both a ClientHello without
  459. * cookie and one with. Ditch the one without.
  460. */
  461. pqueue_pop(s->d1->buffered_messages);
  462. dtls1_hm_fragment_free(frag);
  463. pitem_free(item);
  464. item = next;
  465. frag = nextfrag;
  466. } else {
  467. chretran = 1;
  468. }
  469. } else {
  470. chretran = 1;
  471. }
  472. }
  473. }
  474. } while (item == NULL);
  475. /* Don't return if reassembly still in progress */
  476. if (frag->reassembly != NULL)
  477. return 0;
  478. if (s->d1->handshake_read_seq == frag->msg_header.seq || chretran) {
  479. size_t frag_len = frag->msg_header.frag_len;
  480. pqueue_pop(s->d1->buffered_messages);
  481. /* Calls SSLfatal() as required */
  482. ret = dtls1_preprocess_fragment(s, &frag->msg_header);
  483. if (ret && frag->msg_header.frag_len > 0) {
  484. unsigned char *p =
  485. (unsigned char *)s->init_buf->data + DTLS1_HM_HEADER_LENGTH;
  486. memcpy(&p[frag->msg_header.frag_off], frag->fragment,
  487. frag->msg_header.frag_len);
  488. }
  489. dtls1_hm_fragment_free(frag);
  490. pitem_free(item);
  491. if (ret) {
  492. if (chretran) {
  493. /*
  494. * We got a new ClientHello with a message sequence of 0.
  495. * Reset the read/write sequences back to the beginning.
  496. * We process it like this is the first time we've seen a
  497. * ClientHello from the client.
  498. */
  499. s->d1->handshake_read_seq = 0;
  500. s->d1->next_handshake_write_seq = 0;
  501. }
  502. *len = frag_len;
  503. return 1;
  504. }
  505. /* Fatal error */
  506. s->init_num = 0;
  507. return -1;
  508. } else {
  509. return 0;
  510. }
  511. }
  512. static int dtls1_reassemble_fragment(SSL_CONNECTION *s,
  513. const struct hm_header_st *msg_hdr)
  514. {
  515. hm_fragment *frag = NULL;
  516. pitem *item = NULL;
  517. int i = -1, is_complete;
  518. unsigned char seq64be[8];
  519. size_t frag_len = msg_hdr->frag_len;
  520. size_t readbytes;
  521. SSL *ssl = SSL_CONNECTION_GET_SSL(s);
  522. if ((msg_hdr->frag_off + frag_len) > msg_hdr->msg_len ||
  523. msg_hdr->msg_len > dtls1_max_handshake_message_len(s))
  524. goto err;
  525. if (frag_len == 0) {
  526. return DTLS1_HM_FRAGMENT_RETRY;
  527. }
  528. /* Try to find item in queue */
  529. memset(seq64be, 0, sizeof(seq64be));
  530. seq64be[6] = (unsigned char)(msg_hdr->seq >> 8);
  531. seq64be[7] = (unsigned char)msg_hdr->seq;
  532. item = pqueue_find(s->d1->buffered_messages, seq64be);
  533. if (item == NULL) {
  534. frag = dtls1_hm_fragment_new(msg_hdr->msg_len, 1);
  535. if (frag == NULL)
  536. goto err;
  537. memcpy(&(frag->msg_header), msg_hdr, sizeof(*msg_hdr));
  538. frag->msg_header.frag_len = frag->msg_header.msg_len;
  539. frag->msg_header.frag_off = 0;
  540. } else {
  541. frag = (hm_fragment *)item->data;
  542. if (frag->msg_header.msg_len != msg_hdr->msg_len) {
  543. item = NULL;
  544. frag = NULL;
  545. goto err;
  546. }
  547. }
  548. /*
  549. * If message is already reassembled, this must be a retransmit and can
  550. * be dropped. In this case item != NULL and so frag does not need to be
  551. * freed.
  552. */
  553. if (frag->reassembly == NULL) {
  554. unsigned char devnull[256];
  555. while (frag_len) {
  556. i = ssl->method->ssl_read_bytes(ssl, SSL3_RT_HANDSHAKE, NULL,
  557. devnull,
  558. frag_len >
  559. sizeof(devnull) ? sizeof(devnull) :
  560. frag_len, 0, &readbytes);
  561. if (i <= 0)
  562. goto err;
  563. frag_len -= readbytes;
  564. }
  565. return DTLS1_HM_FRAGMENT_RETRY;
  566. }
  567. /* read the body of the fragment (header has already been read */
  568. i = ssl->method->ssl_read_bytes(ssl, SSL3_RT_HANDSHAKE, NULL,
  569. frag->fragment + msg_hdr->frag_off,
  570. frag_len, 0, &readbytes);
  571. if (i <= 0 || readbytes != frag_len)
  572. i = -1;
  573. if (i <= 0)
  574. goto err;
  575. RSMBLY_BITMASK_MARK(frag->reassembly, (long)msg_hdr->frag_off,
  576. (long)(msg_hdr->frag_off + frag_len));
  577. if (!ossl_assert(msg_hdr->msg_len > 0))
  578. goto err;
  579. RSMBLY_BITMASK_IS_COMPLETE(frag->reassembly, (long)msg_hdr->msg_len,
  580. is_complete);
  581. if (is_complete) {
  582. OPENSSL_free(frag->reassembly);
  583. frag->reassembly = NULL;
  584. }
  585. if (item == NULL) {
  586. item = pitem_new(seq64be, frag);
  587. if (item == NULL) {
  588. i = -1;
  589. goto err;
  590. }
  591. item = pqueue_insert(s->d1->buffered_messages, item);
  592. /*
  593. * pqueue_insert fails iff a duplicate item is inserted. However,
  594. * |item| cannot be a duplicate. If it were, |pqueue_find|, above,
  595. * would have returned it and control would never have reached this
  596. * branch.
  597. */
  598. if (!ossl_assert(item != NULL))
  599. goto err;
  600. }
  601. return DTLS1_HM_FRAGMENT_RETRY;
  602. err:
  603. if (item == NULL)
  604. dtls1_hm_fragment_free(frag);
  605. return -1;
  606. }
  607. static int dtls1_process_out_of_seq_message(SSL_CONNECTION *s,
  608. const struct hm_header_st *msg_hdr)
  609. {
  610. int i = -1;
  611. hm_fragment *frag = NULL;
  612. pitem *item = NULL;
  613. unsigned char seq64be[8];
  614. size_t frag_len = msg_hdr->frag_len;
  615. size_t readbytes;
  616. SSL *ssl = SSL_CONNECTION_GET_SSL(s);
  617. if ((msg_hdr->frag_off + frag_len) > msg_hdr->msg_len)
  618. goto err;
  619. /* Try to find item in queue, to prevent duplicate entries */
  620. memset(seq64be, 0, sizeof(seq64be));
  621. seq64be[6] = (unsigned char)(msg_hdr->seq >> 8);
  622. seq64be[7] = (unsigned char)msg_hdr->seq;
  623. item = pqueue_find(s->d1->buffered_messages, seq64be);
  624. /*
  625. * If we already have an entry and this one is a fragment, don't discard
  626. * it and rather try to reassemble it.
  627. */
  628. if (item != NULL && frag_len != msg_hdr->msg_len)
  629. item = NULL;
  630. /*
  631. * Discard the message if sequence number was already there, is too far
  632. * in the future, already in the queue or if we received a FINISHED
  633. * before the SERVER_HELLO, which then must be a stale retransmit.
  634. */
  635. if (msg_hdr->seq <= s->d1->handshake_read_seq ||
  636. msg_hdr->seq > s->d1->handshake_read_seq + 10 || item != NULL ||
  637. (s->d1->handshake_read_seq == 0 && msg_hdr->type == SSL3_MT_FINISHED)) {
  638. unsigned char devnull[256];
  639. while (frag_len) {
  640. i = ssl->method->ssl_read_bytes(ssl, SSL3_RT_HANDSHAKE, NULL,
  641. devnull,
  642. frag_len >
  643. sizeof(devnull) ? sizeof(devnull) :
  644. frag_len, 0, &readbytes);
  645. if (i <= 0)
  646. goto err;
  647. frag_len -= readbytes;
  648. }
  649. } else {
  650. if (frag_len != msg_hdr->msg_len) {
  651. return dtls1_reassemble_fragment(s, msg_hdr);
  652. }
  653. if (frag_len > dtls1_max_handshake_message_len(s))
  654. goto err;
  655. frag = dtls1_hm_fragment_new(frag_len, 0);
  656. if (frag == NULL)
  657. goto err;
  658. memcpy(&(frag->msg_header), msg_hdr, sizeof(*msg_hdr));
  659. if (frag_len) {
  660. /*
  661. * read the body of the fragment (header has already been read
  662. */
  663. i = ssl->method->ssl_read_bytes(ssl, SSL3_RT_HANDSHAKE, NULL,
  664. frag->fragment, frag_len, 0,
  665. &readbytes);
  666. if (i<=0 || readbytes != frag_len)
  667. i = -1;
  668. if (i <= 0)
  669. goto err;
  670. }
  671. item = pitem_new(seq64be, frag);
  672. if (item == NULL)
  673. goto err;
  674. item = pqueue_insert(s->d1->buffered_messages, item);
  675. /*
  676. * pqueue_insert fails iff a duplicate item is inserted. However,
  677. * |item| cannot be a duplicate. If it were, |pqueue_find|, above,
  678. * would have returned it. Then, either |frag_len| !=
  679. * |msg_hdr->msg_len| in which case |item| is set to NULL and it will
  680. * have been processed with |dtls1_reassemble_fragment|, above, or
  681. * the record will have been discarded.
  682. */
  683. if (!ossl_assert(item != NULL))
  684. goto err;
  685. }
  686. return DTLS1_HM_FRAGMENT_RETRY;
  687. err:
  688. if (item == NULL)
  689. dtls1_hm_fragment_free(frag);
  690. return 0;
  691. }
  692. static int dtls_get_reassembled_message(SSL_CONNECTION *s, int *errtype,
  693. size_t *len)
  694. {
  695. unsigned char wire[DTLS1_HM_HEADER_LENGTH];
  696. size_t mlen, frag_off, frag_len;
  697. int i, ret;
  698. uint8_t recvd_type;
  699. struct hm_header_st msg_hdr;
  700. size_t readbytes;
  701. SSL *ssl = SSL_CONNECTION_GET_SSL(s);
  702. int chretran = 0;
  703. *errtype = 0;
  704. redo:
  705. /* see if we have the required fragment already */
  706. ret = dtls1_retrieve_buffered_fragment(s, &frag_len);
  707. if (ret < 0) {
  708. /* SSLfatal() already called */
  709. return 0;
  710. }
  711. if (ret > 0) {
  712. s->init_num = frag_len;
  713. *len = frag_len;
  714. return 1;
  715. }
  716. /* read handshake message header */
  717. i = ssl->method->ssl_read_bytes(ssl, SSL3_RT_HANDSHAKE, &recvd_type, wire,
  718. DTLS1_HM_HEADER_LENGTH, 0, &readbytes);
  719. if (i <= 0) { /* nbio, or an error */
  720. s->rwstate = SSL_READING;
  721. *len = 0;
  722. return 0;
  723. }
  724. if (recvd_type == SSL3_RT_CHANGE_CIPHER_SPEC) {
  725. if (wire[0] != SSL3_MT_CCS) {
  726. SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE,
  727. SSL_R_BAD_CHANGE_CIPHER_SPEC);
  728. goto f_err;
  729. }
  730. memcpy(s->init_buf->data, wire, readbytes);
  731. s->init_num = readbytes - 1;
  732. s->init_msg = s->init_buf->data + 1;
  733. s->s3.tmp.message_type = SSL3_MT_CHANGE_CIPHER_SPEC;
  734. s->s3.tmp.message_size = readbytes - 1;
  735. *len = readbytes - 1;
  736. return 1;
  737. }
  738. /* Handshake fails if message header is incomplete */
  739. if (readbytes != DTLS1_HM_HEADER_LENGTH) {
  740. SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
  741. goto f_err;
  742. }
  743. /* parse the message fragment header */
  744. dtls1_get_message_header(wire, &msg_hdr);
  745. mlen = msg_hdr.msg_len;
  746. frag_off = msg_hdr.frag_off;
  747. frag_len = msg_hdr.frag_len;
  748. /*
  749. * We must have at least frag_len bytes left in the record to be read.
  750. * Fragments must not span records.
  751. */
  752. if (frag_len > s->rlayer.tlsrecs[s->rlayer.curr_rec].length) {
  753. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_LENGTH);
  754. goto f_err;
  755. }
  756. /*
  757. * if this is a future (or stale) message it gets buffered
  758. * (or dropped)--no further processing at this time
  759. * While listening, we accept seq 1 (ClientHello with cookie)
  760. * although we're still expecting seq 0 (ClientHello)
  761. */
  762. if (msg_hdr.seq != s->d1->handshake_read_seq) {
  763. if (!s->server
  764. || msg_hdr.seq != 0
  765. || s->d1->handshake_read_seq != 1
  766. || wire[0] != SSL3_MT_CLIENT_HELLO
  767. || s->statem.hand_state != DTLS_ST_SW_HELLO_VERIFY_REQUEST) {
  768. *errtype = dtls1_process_out_of_seq_message(s, &msg_hdr);
  769. return 0;
  770. }
  771. /*
  772. * We received a ClientHello and sent back a HelloVerifyRequest. We
  773. * now seem to have received a retransmitted initial ClientHello. That
  774. * is allowed (possibly our HelloVerifyRequest got lost).
  775. */
  776. chretran = 1;
  777. }
  778. if (frag_len && frag_len < mlen) {
  779. *errtype = dtls1_reassemble_fragment(s, &msg_hdr);
  780. return 0;
  781. }
  782. if (!s->server
  783. && s->d1->r_msg_hdr.frag_off == 0
  784. && s->statem.hand_state != TLS_ST_OK
  785. && wire[0] == SSL3_MT_HELLO_REQUEST) {
  786. /*
  787. * The server may always send 'Hello Request' messages -- we are
  788. * doing a handshake anyway now, so ignore them if their format is
  789. * correct. Does not count for 'Finished' MAC.
  790. */
  791. if (wire[1] == 0 && wire[2] == 0 && wire[3] == 0) {
  792. if (s->msg_callback)
  793. s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,
  794. wire, DTLS1_HM_HEADER_LENGTH, ssl,
  795. s->msg_callback_arg);
  796. s->init_num = 0;
  797. goto redo;
  798. } else { /* Incorrectly formatted Hello request */
  799. SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
  800. goto f_err;
  801. }
  802. }
  803. if (!dtls1_preprocess_fragment(s, &msg_hdr)) {
  804. /* SSLfatal() already called */
  805. goto f_err;
  806. }
  807. if (frag_len > 0) {
  808. unsigned char *p =
  809. (unsigned char *)s->init_buf->data + DTLS1_HM_HEADER_LENGTH;
  810. i = ssl->method->ssl_read_bytes(ssl, SSL3_RT_HANDSHAKE, NULL,
  811. &p[frag_off], frag_len, 0, &readbytes);
  812. /*
  813. * This shouldn't ever fail due to NBIO because we already checked
  814. * that we have enough data in the record
  815. */
  816. if (i <= 0) {
  817. s->rwstate = SSL_READING;
  818. *len = 0;
  819. return 0;
  820. }
  821. } else {
  822. readbytes = 0;
  823. }
  824. /*
  825. * XDTLS: an incorrectly formatted fragment should cause the handshake
  826. * to fail
  827. */
  828. if (readbytes != frag_len) {
  829. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_LENGTH);
  830. goto f_err;
  831. }
  832. if (chretran) {
  833. /*
  834. * We got a new ClientHello with a message sequence of 0.
  835. * Reset the read/write sequences back to the beginning.
  836. * We process it like this is the first time we've seen a ClientHello
  837. * from the client.
  838. */
  839. s->d1->handshake_read_seq = 0;
  840. s->d1->next_handshake_write_seq = 0;
  841. }
  842. /*
  843. * Note that s->init_num is *not* used as current offset in
  844. * s->init_buf->data, but as a counter summing up fragments' lengths: as
  845. * soon as they sum up to handshake packet length, we assume we have got
  846. * all the fragments.
  847. */
  848. *len = s->init_num = frag_len;
  849. return 1;
  850. f_err:
  851. s->init_num = 0;
  852. *len = 0;
  853. return 0;
  854. }
  855. /*-
  856. * for these 2 messages, we need to
  857. * ssl->session->read_sym_enc assign
  858. * ssl->session->read_compression assign
  859. * ssl->session->read_hash assign
  860. */
  861. CON_FUNC_RETURN dtls_construct_change_cipher_spec(SSL_CONNECTION *s,
  862. WPACKET *pkt)
  863. {
  864. if (s->version == DTLS1_BAD_VER) {
  865. s->d1->next_handshake_write_seq++;
  866. if (!WPACKET_put_bytes_u16(pkt, s->d1->handshake_write_seq)) {
  867. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  868. return CON_FUNC_ERROR;
  869. }
  870. }
  871. return CON_FUNC_SUCCESS;
  872. }
  873. #ifndef OPENSSL_NO_SCTP
  874. /*
  875. * Wait for a dry event. Should only be called at a point in the handshake
  876. * where we are not expecting any data from the peer except an alert.
  877. */
  878. WORK_STATE dtls_wait_for_dry(SSL_CONNECTION *s)
  879. {
  880. int ret, errtype;
  881. size_t len;
  882. SSL *ssl = SSL_CONNECTION_GET_SSL(s);
  883. /* read app data until dry event */
  884. ret = BIO_dgram_sctp_wait_for_dry(SSL_get_wbio(ssl));
  885. if (ret < 0) {
  886. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  887. return WORK_ERROR;
  888. }
  889. if (ret == 0) {
  890. /*
  891. * We're not expecting any more messages from the peer at this point -
  892. * but we could get an alert. If an alert is waiting then we will never
  893. * return successfully. Therefore we attempt to read a message. This
  894. * should never succeed but will process any waiting alerts.
  895. */
  896. if (dtls_get_reassembled_message(s, &errtype, &len)) {
  897. /* The call succeeded! This should never happen */
  898. SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
  899. return WORK_ERROR;
  900. }
  901. s->s3.in_read_app_data = 2;
  902. s->rwstate = SSL_READING;
  903. BIO_clear_retry_flags(SSL_get_rbio(ssl));
  904. BIO_set_retry_read(SSL_get_rbio(ssl));
  905. return WORK_MORE_A;
  906. }
  907. return WORK_FINISHED_CONTINUE;
  908. }
  909. #endif
  910. int dtls1_read_failed(SSL_CONNECTION *s, int code)
  911. {
  912. SSL *ssl = SSL_CONNECTION_GET_SSL(s);
  913. if (code > 0) {
  914. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  915. return 0;
  916. }
  917. if (!dtls1_is_timer_expired(s) || ossl_statem_in_error(s)) {
  918. /*
  919. * not a timeout, none of our business, let higher layers handle
  920. * this. in fact it's probably an error
  921. */
  922. return code;
  923. }
  924. /* done, no need to send a retransmit */
  925. if (!SSL_in_init(ssl))
  926. {
  927. BIO_set_flags(SSL_get_rbio(ssl), BIO_FLAGS_READ);
  928. return code;
  929. }
  930. return dtls1_handle_timeout(s);
  931. }
  932. int dtls1_get_queue_priority(unsigned short seq, int is_ccs)
  933. {
  934. /*
  935. * The index of the retransmission queue actually is the message sequence
  936. * number, since the queue only contains messages of a single handshake.
  937. * However, the ChangeCipherSpec has no message sequence number and so
  938. * using only the sequence will result in the CCS and Finished having the
  939. * same index. To prevent this, the sequence number is multiplied by 2.
  940. * In case of a CCS 1 is subtracted. This does not only differ CSS and
  941. * Finished, it also maintains the order of the index (important for
  942. * priority queues) and fits in the unsigned short variable.
  943. */
  944. return seq * 2 - is_ccs;
  945. }
  946. int dtls1_retransmit_buffered_messages(SSL_CONNECTION *s)
  947. {
  948. pqueue *sent = s->d1->sent_messages;
  949. piterator iter;
  950. pitem *item;
  951. hm_fragment *frag;
  952. int found = 0;
  953. iter = pqueue_iterator(sent);
  954. for (item = pqueue_next(&iter); item != NULL; item = pqueue_next(&iter)) {
  955. frag = (hm_fragment *)item->data;
  956. if (dtls1_retransmit_message(s, (unsigned short)
  957. dtls1_get_queue_priority
  958. (frag->msg_header.seq,
  959. frag->msg_header.is_ccs), &found) <= 0)
  960. return -1;
  961. }
  962. return 1;
  963. }
  964. int dtls1_buffer_message(SSL_CONNECTION *s, int is_ccs)
  965. {
  966. pitem *item;
  967. hm_fragment *frag;
  968. unsigned char seq64be[8];
  969. /*
  970. * this function is called immediately after a message has been
  971. * serialized
  972. */
  973. if (!ossl_assert(s->init_off == 0))
  974. return 0;
  975. frag = dtls1_hm_fragment_new(s->init_num, 0);
  976. if (frag == NULL)
  977. return 0;
  978. memcpy(frag->fragment, s->init_buf->data, s->init_num);
  979. if (is_ccs) {
  980. /* For DTLS1_BAD_VER the header length is non-standard */
  981. if (!ossl_assert(s->d1->w_msg_hdr.msg_len +
  982. ((s->version ==
  983. DTLS1_BAD_VER) ? 3 : DTLS1_CCS_HEADER_LENGTH)
  984. == (unsigned int)s->init_num)) {
  985. dtls1_hm_fragment_free(frag);
  986. return 0;
  987. }
  988. } else {
  989. if (!ossl_assert(s->d1->w_msg_hdr.msg_len +
  990. DTLS1_HM_HEADER_LENGTH == (unsigned int)s->init_num)) {
  991. dtls1_hm_fragment_free(frag);
  992. return 0;
  993. }
  994. }
  995. frag->msg_header.msg_len = s->d1->w_msg_hdr.msg_len;
  996. frag->msg_header.seq = s->d1->w_msg_hdr.seq;
  997. frag->msg_header.type = s->d1->w_msg_hdr.type;
  998. frag->msg_header.frag_off = 0;
  999. frag->msg_header.frag_len = s->d1->w_msg_hdr.msg_len;
  1000. frag->msg_header.is_ccs = is_ccs;
  1001. /* save current state */
  1002. frag->msg_header.saved_retransmit_state.wrlmethod = s->rlayer.wrlmethod;
  1003. frag->msg_header.saved_retransmit_state.wrl = s->rlayer.wrl;
  1004. memset(seq64be, 0, sizeof(seq64be));
  1005. seq64be[6] =
  1006. (unsigned
  1007. char)(dtls1_get_queue_priority(frag->msg_header.seq,
  1008. frag->msg_header.is_ccs) >> 8);
  1009. seq64be[7] =
  1010. (unsigned
  1011. char)(dtls1_get_queue_priority(frag->msg_header.seq,
  1012. frag->msg_header.is_ccs));
  1013. item = pitem_new(seq64be, frag);
  1014. if (item == NULL) {
  1015. dtls1_hm_fragment_free(frag);
  1016. return 0;
  1017. }
  1018. pqueue_insert(s->d1->sent_messages, item);
  1019. return 1;
  1020. }
  1021. int dtls1_retransmit_message(SSL_CONNECTION *s, unsigned short seq, int *found)
  1022. {
  1023. int ret;
  1024. /* XDTLS: for now assuming that read/writes are blocking */
  1025. pitem *item;
  1026. hm_fragment *frag;
  1027. unsigned long header_length;
  1028. unsigned char seq64be[8];
  1029. struct dtls1_retransmit_state saved_state;
  1030. /* XDTLS: the requested message ought to be found, otherwise error */
  1031. memset(seq64be, 0, sizeof(seq64be));
  1032. seq64be[6] = (unsigned char)(seq >> 8);
  1033. seq64be[7] = (unsigned char)seq;
  1034. item = pqueue_find(s->d1->sent_messages, seq64be);
  1035. if (item == NULL) {
  1036. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  1037. *found = 0;
  1038. return 0;
  1039. }
  1040. *found = 1;
  1041. frag = (hm_fragment *)item->data;
  1042. if (frag->msg_header.is_ccs)
  1043. header_length = DTLS1_CCS_HEADER_LENGTH;
  1044. else
  1045. header_length = DTLS1_HM_HEADER_LENGTH;
  1046. memcpy(s->init_buf->data, frag->fragment,
  1047. frag->msg_header.msg_len + header_length);
  1048. s->init_num = frag->msg_header.msg_len + header_length;
  1049. dtls1_set_message_header_int(s, frag->msg_header.type,
  1050. frag->msg_header.msg_len,
  1051. frag->msg_header.seq, 0,
  1052. frag->msg_header.frag_len);
  1053. /* save current state */
  1054. saved_state.wrlmethod = s->rlayer.wrlmethod;
  1055. saved_state.wrl = s->rlayer.wrl;
  1056. s->d1->retransmitting = 1;
  1057. /* restore state in which the message was originally sent */
  1058. s->rlayer.wrlmethod = frag->msg_header.saved_retransmit_state.wrlmethod;
  1059. s->rlayer.wrl = frag->msg_header.saved_retransmit_state.wrl;
  1060. /*
  1061. * The old wrl may be still pointing at an old BIO. Update it to what we're
  1062. * using now.
  1063. */
  1064. s->rlayer.wrlmethod->set1_bio(s->rlayer.wrl, s->wbio);
  1065. ret = dtls1_do_write(s, frag->msg_header.is_ccs ?
  1066. SSL3_RT_CHANGE_CIPHER_SPEC : SSL3_RT_HANDSHAKE);
  1067. /* restore current state */
  1068. s->rlayer.wrlmethod = saved_state.wrlmethod;
  1069. s->rlayer.wrl = saved_state.wrl;
  1070. s->d1->retransmitting = 0;
  1071. (void)BIO_flush(s->wbio);
  1072. return ret;
  1073. }
  1074. void dtls1_set_message_header(SSL_CONNECTION *s,
  1075. unsigned char mt, size_t len,
  1076. size_t frag_off, size_t frag_len)
  1077. {
  1078. if (frag_off == 0) {
  1079. s->d1->handshake_write_seq = s->d1->next_handshake_write_seq;
  1080. s->d1->next_handshake_write_seq++;
  1081. }
  1082. dtls1_set_message_header_int(s, mt, len, s->d1->handshake_write_seq,
  1083. frag_off, frag_len);
  1084. }
  1085. /* don't actually do the writing, wait till the MTU has been retrieved */
  1086. static void
  1087. dtls1_set_message_header_int(SSL_CONNECTION *s, unsigned char mt,
  1088. size_t len, unsigned short seq_num,
  1089. size_t frag_off, size_t frag_len)
  1090. {
  1091. struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr;
  1092. msg_hdr->type = mt;
  1093. msg_hdr->msg_len = len;
  1094. msg_hdr->seq = seq_num;
  1095. msg_hdr->frag_off = frag_off;
  1096. msg_hdr->frag_len = frag_len;
  1097. }
  1098. static void
  1099. dtls1_fix_message_header(SSL_CONNECTION *s, size_t frag_off, size_t frag_len)
  1100. {
  1101. struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr;
  1102. msg_hdr->frag_off = frag_off;
  1103. msg_hdr->frag_len = frag_len;
  1104. }
  1105. static unsigned char *dtls1_write_message_header(SSL_CONNECTION *s,
  1106. unsigned char *p)
  1107. {
  1108. struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr;
  1109. *p++ = msg_hdr->type;
  1110. l2n3(msg_hdr->msg_len, p);
  1111. s2n(msg_hdr->seq, p);
  1112. l2n3(msg_hdr->frag_off, p);
  1113. l2n3(msg_hdr->frag_len, p);
  1114. return p;
  1115. }
  1116. void dtls1_get_message_header(const unsigned char *data, struct
  1117. hm_header_st *msg_hdr)
  1118. {
  1119. memset(msg_hdr, 0, sizeof(*msg_hdr));
  1120. msg_hdr->type = *(data++);
  1121. n2l3(data, msg_hdr->msg_len);
  1122. n2s(data, msg_hdr->seq);
  1123. n2l3(data, msg_hdr->frag_off);
  1124. n2l3(data, msg_hdr->frag_len);
  1125. }
  1126. int dtls1_set_handshake_header(SSL_CONNECTION *s, WPACKET *pkt, int htype)
  1127. {
  1128. unsigned char *header;
  1129. if (htype == SSL3_MT_CHANGE_CIPHER_SPEC) {
  1130. s->d1->handshake_write_seq = s->d1->next_handshake_write_seq;
  1131. dtls1_set_message_header_int(s, SSL3_MT_CCS, 0,
  1132. s->d1->handshake_write_seq, 0, 0);
  1133. if (!WPACKET_put_bytes_u8(pkt, SSL3_MT_CCS))
  1134. return 0;
  1135. } else {
  1136. dtls1_set_message_header(s, htype, 0, 0, 0);
  1137. /*
  1138. * We allocate space at the start for the message header. This gets
  1139. * filled in later
  1140. */
  1141. if (!WPACKET_allocate_bytes(pkt, DTLS1_HM_HEADER_LENGTH, &header)
  1142. || !WPACKET_start_sub_packet(pkt))
  1143. return 0;
  1144. }
  1145. return 1;
  1146. }
  1147. int dtls1_close_construct_packet(SSL_CONNECTION *s, WPACKET *pkt, int htype)
  1148. {
  1149. size_t msglen;
  1150. if ((htype != SSL3_MT_CHANGE_CIPHER_SPEC && !WPACKET_close(pkt))
  1151. || !WPACKET_get_length(pkt, &msglen)
  1152. || msglen > INT_MAX)
  1153. return 0;
  1154. if (htype != SSL3_MT_CHANGE_CIPHER_SPEC) {
  1155. s->d1->w_msg_hdr.msg_len = msglen - DTLS1_HM_HEADER_LENGTH;
  1156. s->d1->w_msg_hdr.frag_len = msglen - DTLS1_HM_HEADER_LENGTH;
  1157. }
  1158. s->init_num = (int)msglen;
  1159. s->init_off = 0;
  1160. if (htype != DTLS1_MT_HELLO_VERIFY_REQUEST) {
  1161. /* Buffer the message to handle re-xmits */
  1162. if (!dtls1_buffer_message(s, htype == SSL3_MT_CHANGE_CIPHER_SPEC
  1163. ? 1 : 0))
  1164. return 0;
  1165. }
  1166. return 1;
  1167. }