statem.c 30 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979
  1. /*
  2. * Copyright 2015-2022 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #if defined(__TANDEM) && defined(_SPT_MODEL_)
  10. # include <spthread.h>
  11. # include <spt_extensions.h> /* timeval */
  12. #endif
  13. #include "internal/cryptlib.h"
  14. #include <openssl/rand.h>
  15. #include "../ssl_local.h"
  16. #include "statem_local.h"
  17. #include <assert.h>
  18. /*
  19. * This file implements the SSL/TLS/DTLS state machines.
  20. *
  21. * There are two primary state machines:
  22. *
  23. * 1) Message flow state machine
  24. * 2) Handshake state machine
  25. *
  26. * The Message flow state machine controls the reading and sending of messages
  27. * including handling of non-blocking IO events, flushing of the underlying
  28. * write BIO, handling unexpected messages, etc. It is itself broken into two
  29. * separate sub-state machines which control reading and writing respectively.
  30. *
  31. * The Handshake state machine keeps track of the current SSL/TLS handshake
  32. * state. Transitions of the handshake state are the result of events that
  33. * occur within the Message flow state machine.
  34. *
  35. * Overall it looks like this:
  36. *
  37. * --------------------------------------------- -------------------
  38. * | | | |
  39. * | Message flow state machine | | |
  40. * | | | |
  41. * | -------------------- -------------------- | Transition | Handshake state |
  42. * | | MSG_FLOW_READING | | MSG_FLOW_WRITING | | Event | machine |
  43. * | | sub-state | | sub-state | |----------->| |
  44. * | | machine for | | machine for | | | |
  45. * | | reading messages | | writing messages | | | |
  46. * | -------------------- -------------------- | | |
  47. * | | | |
  48. * --------------------------------------------- -------------------
  49. *
  50. */
  51. /* Sub state machine return values */
  52. typedef enum {
  53. /* Something bad happened or NBIO */
  54. SUB_STATE_ERROR,
  55. /* Sub state finished go to the next sub state */
  56. SUB_STATE_FINISHED,
  57. /* Sub state finished and handshake was completed */
  58. SUB_STATE_END_HANDSHAKE
  59. } SUB_STATE_RETURN;
  60. static int state_machine(SSL *s, int server);
  61. static void init_read_state_machine(SSL *s);
  62. static SUB_STATE_RETURN read_state_machine(SSL *s);
  63. static void init_write_state_machine(SSL *s);
  64. static SUB_STATE_RETURN write_state_machine(SSL *s);
  65. OSSL_HANDSHAKE_STATE SSL_get_state(const SSL *ssl)
  66. {
  67. return ssl->statem.hand_state;
  68. }
  69. int SSL_in_init(const SSL *s)
  70. {
  71. return s->statem.in_init;
  72. }
  73. int SSL_is_init_finished(const SSL *s)
  74. {
  75. return !(s->statem.in_init) && (s->statem.hand_state == TLS_ST_OK);
  76. }
  77. int SSL_in_before(const SSL *s)
  78. {
  79. /*
  80. * Historically being "in before" meant before anything had happened. In the
  81. * current code though we remain in the "before" state for a while after we
  82. * have started the handshake process (e.g. as a server waiting for the
  83. * first message to arrive). There "in before" is taken to mean "in before"
  84. * and not started any handshake process yet.
  85. */
  86. return (s->statem.hand_state == TLS_ST_BEFORE)
  87. && (s->statem.state == MSG_FLOW_UNINITED);
  88. }
  89. /*
  90. * Clear the state machine state and reset back to MSG_FLOW_UNINITED
  91. */
  92. void ossl_statem_clear(SSL *s)
  93. {
  94. s->statem.state = MSG_FLOW_UNINITED;
  95. s->statem.hand_state = TLS_ST_BEFORE;
  96. s->statem.in_init = 1;
  97. s->statem.no_cert_verify = 0;
  98. }
  99. /*
  100. * Set the state machine up ready for a renegotiation handshake
  101. */
  102. void ossl_statem_set_renegotiate(SSL *s)
  103. {
  104. s->statem.in_init = 1;
  105. s->statem.request_state = TLS_ST_SW_HELLO_REQ;
  106. }
  107. void ossl_statem_send_fatal(SSL *s, int al)
  108. {
  109. /* We shouldn't call SSLfatal() twice. Once is enough */
  110. if (s->statem.in_init && s->statem.state == MSG_FLOW_ERROR)
  111. return;
  112. s->statem.in_init = 1;
  113. s->statem.state = MSG_FLOW_ERROR;
  114. if (al != SSL_AD_NO_ALERT
  115. && s->statem.enc_write_state != ENC_WRITE_STATE_INVALID)
  116. ssl3_send_alert(s, SSL3_AL_FATAL, al);
  117. }
  118. /*
  119. * Error reporting building block that's used instead of ERR_set_error().
  120. * In addition to what ERR_set_error() does, this puts the state machine
  121. * into an error state and sends an alert if appropriate.
  122. * This is a permanent error for the current connection.
  123. */
  124. void ossl_statem_fatal(SSL *s, int al, int reason, const char *fmt, ...)
  125. {
  126. va_list args;
  127. va_start(args, fmt);
  128. ERR_vset_error(ERR_LIB_SSL, reason, fmt, args);
  129. va_end(args);
  130. ossl_statem_send_fatal(s, al);
  131. }
  132. /*
  133. * This macro should only be called if we are already expecting to be in
  134. * a fatal error state. We verify that we are, and set it if not (this would
  135. * indicate a bug).
  136. */
  137. #define check_fatal(s) \
  138. do { \
  139. if (!ossl_assert((s)->statem.in_init \
  140. && (s)->statem.state == MSG_FLOW_ERROR)) \
  141. SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_MISSING_FATAL); \
  142. } while (0)
  143. /*
  144. * Discover whether the current connection is in the error state.
  145. *
  146. * Valid return values are:
  147. * 1: Yes
  148. * 0: No
  149. */
  150. int ossl_statem_in_error(const SSL *s)
  151. {
  152. if (s->statem.state == MSG_FLOW_ERROR)
  153. return 1;
  154. return 0;
  155. }
  156. void ossl_statem_set_in_init(SSL *s, int init)
  157. {
  158. s->statem.in_init = init;
  159. }
  160. int ossl_statem_get_in_handshake(SSL *s)
  161. {
  162. return s->statem.in_handshake;
  163. }
  164. void ossl_statem_set_in_handshake(SSL *s, int inhand)
  165. {
  166. if (inhand)
  167. s->statem.in_handshake++;
  168. else
  169. s->statem.in_handshake--;
  170. }
  171. /* Are we in a sensible state to skip over unreadable early data? */
  172. int ossl_statem_skip_early_data(SSL *s)
  173. {
  174. if (s->ext.early_data != SSL_EARLY_DATA_REJECTED)
  175. return 0;
  176. if (!s->server
  177. || s->statem.hand_state != TLS_ST_EARLY_DATA
  178. || s->hello_retry_request == SSL_HRR_COMPLETE)
  179. return 0;
  180. return 1;
  181. }
  182. /*
  183. * Called when we are in SSL_read*(), SSL_write*(), or SSL_accept()
  184. * /SSL_connect()/SSL_do_handshake(). Used to test whether we are in an early
  185. * data state and whether we should attempt to move the handshake on if so.
  186. * |sending| is 1 if we are attempting to send data (SSL_write*()), 0 if we are
  187. * attempting to read data (SSL_read*()), or -1 if we are in SSL_do_handshake()
  188. * or similar.
  189. */
  190. void ossl_statem_check_finish_init(SSL *s, int sending)
  191. {
  192. if (sending == -1) {
  193. if (s->statem.hand_state == TLS_ST_PENDING_EARLY_DATA_END
  194. || s->statem.hand_state == TLS_ST_EARLY_DATA) {
  195. ossl_statem_set_in_init(s, 1);
  196. if (s->early_data_state == SSL_EARLY_DATA_WRITE_RETRY) {
  197. /*
  198. * SSL_connect() or SSL_do_handshake() has been called directly.
  199. * We don't allow any more writing of early data.
  200. */
  201. s->early_data_state = SSL_EARLY_DATA_FINISHED_WRITING;
  202. }
  203. }
  204. } else if (!s->server) {
  205. if ((sending && (s->statem.hand_state == TLS_ST_PENDING_EARLY_DATA_END
  206. || s->statem.hand_state == TLS_ST_EARLY_DATA)
  207. && s->early_data_state != SSL_EARLY_DATA_WRITING)
  208. || (!sending && s->statem.hand_state == TLS_ST_EARLY_DATA)) {
  209. ossl_statem_set_in_init(s, 1);
  210. /*
  211. * SSL_write() has been called directly. We don't allow any more
  212. * writing of early data.
  213. */
  214. if (sending && s->early_data_state == SSL_EARLY_DATA_WRITE_RETRY)
  215. s->early_data_state = SSL_EARLY_DATA_FINISHED_WRITING;
  216. }
  217. } else {
  218. if (s->early_data_state == SSL_EARLY_DATA_FINISHED_READING
  219. && s->statem.hand_state == TLS_ST_EARLY_DATA)
  220. ossl_statem_set_in_init(s, 1);
  221. }
  222. }
  223. void ossl_statem_set_hello_verify_done(SSL *s)
  224. {
  225. s->statem.state = MSG_FLOW_UNINITED;
  226. s->statem.in_init = 1;
  227. /*
  228. * This will get reset (briefly) back to TLS_ST_BEFORE when we enter
  229. * state_machine() because |state| is MSG_FLOW_UNINITED, but until then any
  230. * calls to SSL_in_before() will return false. Also calls to
  231. * SSL_state_string() and SSL_state_string_long() will return something
  232. * sensible.
  233. */
  234. s->statem.hand_state = TLS_ST_SR_CLNT_HELLO;
  235. }
  236. int ossl_statem_connect(SSL *s)
  237. {
  238. return state_machine(s, 0);
  239. }
  240. int ossl_statem_accept(SSL *s)
  241. {
  242. return state_machine(s, 1);
  243. }
  244. typedef void (*info_cb) (const SSL *, int, int);
  245. static info_cb get_callback(SSL *s)
  246. {
  247. if (s->info_callback != NULL)
  248. return s->info_callback;
  249. else if (s->ctx->info_callback != NULL)
  250. return s->ctx->info_callback;
  251. return NULL;
  252. }
  253. /*
  254. * The main message flow state machine. We start in the MSG_FLOW_UNINITED or
  255. * MSG_FLOW_FINISHED state and finish in MSG_FLOW_FINISHED. Valid states and
  256. * transitions are as follows:
  257. *
  258. * MSG_FLOW_UNINITED MSG_FLOW_FINISHED
  259. * | |
  260. * +-----------------------+
  261. * v
  262. * MSG_FLOW_WRITING <---> MSG_FLOW_READING
  263. * |
  264. * V
  265. * MSG_FLOW_FINISHED
  266. * |
  267. * V
  268. * [SUCCESS]
  269. *
  270. * We may exit at any point due to an error or NBIO event. If an NBIO event
  271. * occurs then we restart at the point we left off when we are recalled.
  272. * MSG_FLOW_WRITING and MSG_FLOW_READING have sub-state machines associated with them.
  273. *
  274. * In addition to the above there is also the MSG_FLOW_ERROR state. We can move
  275. * into that state at any point in the event that an irrecoverable error occurs.
  276. *
  277. * Valid return values are:
  278. * 1: Success
  279. * <=0: NBIO or error
  280. */
  281. static int state_machine(SSL *s, int server)
  282. {
  283. BUF_MEM *buf = NULL;
  284. void (*cb) (const SSL *ssl, int type, int val) = NULL;
  285. OSSL_STATEM *st = &s->statem;
  286. int ret = -1;
  287. int ssret;
  288. if (st->state == MSG_FLOW_ERROR) {
  289. /* Shouldn't have been called if we're already in the error state */
  290. return -1;
  291. }
  292. ERR_clear_error();
  293. clear_sys_error();
  294. cb = get_callback(s);
  295. st->in_handshake++;
  296. if (!SSL_in_init(s) || SSL_in_before(s)) {
  297. /*
  298. * If we are stateless then we already called SSL_clear() - don't do
  299. * it again and clear the STATELESS flag itself.
  300. */
  301. if ((s->s3.flags & TLS1_FLAGS_STATELESS) == 0 && !SSL_clear(s))
  302. return -1;
  303. }
  304. #ifndef OPENSSL_NO_SCTP
  305. if (SSL_IS_DTLS(s) && BIO_dgram_is_sctp(SSL_get_wbio(s))) {
  306. /*
  307. * Notify SCTP BIO socket to enter handshake mode and prevent stream
  308. * identifier other than 0.
  309. */
  310. BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE,
  311. st->in_handshake, NULL);
  312. }
  313. #endif
  314. /* Initialise state machine */
  315. if (st->state == MSG_FLOW_UNINITED
  316. || st->state == MSG_FLOW_FINISHED) {
  317. if (st->state == MSG_FLOW_UNINITED) {
  318. st->hand_state = TLS_ST_BEFORE;
  319. st->request_state = TLS_ST_BEFORE;
  320. }
  321. s->server = server;
  322. if (cb != NULL) {
  323. if (SSL_IS_FIRST_HANDSHAKE(s) || !SSL_IS_TLS13(s))
  324. cb(s, SSL_CB_HANDSHAKE_START, 1);
  325. }
  326. /*
  327. * Fatal errors in this block don't send an alert because we have
  328. * failed to even initialise properly. Sending an alert is probably
  329. * doomed to failure.
  330. */
  331. if (SSL_IS_DTLS(s)) {
  332. if ((s->version & 0xff00) != (DTLS1_VERSION & 0xff00) &&
  333. (server || (s->version & 0xff00) != (DTLS1_BAD_VER & 0xff00))) {
  334. SSLfatal(s, SSL_AD_NO_ALERT, ERR_R_INTERNAL_ERROR);
  335. goto end;
  336. }
  337. } else {
  338. if ((s->version >> 8) != SSL3_VERSION_MAJOR) {
  339. SSLfatal(s, SSL_AD_NO_ALERT, ERR_R_INTERNAL_ERROR);
  340. goto end;
  341. }
  342. }
  343. if (!ssl_security(s, SSL_SECOP_VERSION, 0, s->version, NULL)) {
  344. SSLfatal(s, SSL_AD_NO_ALERT, ERR_R_INTERNAL_ERROR);
  345. goto end;
  346. }
  347. if (s->init_buf == NULL) {
  348. if ((buf = BUF_MEM_new()) == NULL) {
  349. SSLfatal(s, SSL_AD_NO_ALERT, ERR_R_INTERNAL_ERROR);
  350. goto end;
  351. }
  352. if (!BUF_MEM_grow(buf, SSL3_RT_MAX_PLAIN_LENGTH)) {
  353. SSLfatal(s, SSL_AD_NO_ALERT, ERR_R_INTERNAL_ERROR);
  354. goto end;
  355. }
  356. s->init_buf = buf;
  357. buf = NULL;
  358. }
  359. if (!ssl3_setup_buffers(s)) {
  360. SSLfatal(s, SSL_AD_NO_ALERT, ERR_R_INTERNAL_ERROR);
  361. goto end;
  362. }
  363. s->init_num = 0;
  364. /*
  365. * Should have been reset by tls_process_finished, too.
  366. */
  367. s->s3.change_cipher_spec = 0;
  368. /*
  369. * Ok, we now need to push on a buffering BIO ...but not with
  370. * SCTP
  371. */
  372. #ifndef OPENSSL_NO_SCTP
  373. if (!SSL_IS_DTLS(s) || !BIO_dgram_is_sctp(SSL_get_wbio(s)))
  374. #endif
  375. if (!ssl_init_wbio_buffer(s)) {
  376. SSLfatal(s, SSL_AD_NO_ALERT, ERR_R_INTERNAL_ERROR);
  377. goto end;
  378. }
  379. if ((SSL_in_before(s))
  380. || s->renegotiate) {
  381. if (!tls_setup_handshake(s)) {
  382. /* SSLfatal() already called */
  383. goto end;
  384. }
  385. if (SSL_IS_FIRST_HANDSHAKE(s))
  386. st->read_state_first_init = 1;
  387. }
  388. st->state = MSG_FLOW_WRITING;
  389. init_write_state_machine(s);
  390. }
  391. while (st->state != MSG_FLOW_FINISHED) {
  392. if (st->state == MSG_FLOW_READING) {
  393. ssret = read_state_machine(s);
  394. if (ssret == SUB_STATE_FINISHED) {
  395. st->state = MSG_FLOW_WRITING;
  396. init_write_state_machine(s);
  397. } else {
  398. /* NBIO or error */
  399. goto end;
  400. }
  401. } else if (st->state == MSG_FLOW_WRITING) {
  402. ssret = write_state_machine(s);
  403. if (ssret == SUB_STATE_FINISHED) {
  404. st->state = MSG_FLOW_READING;
  405. init_read_state_machine(s);
  406. } else if (ssret == SUB_STATE_END_HANDSHAKE) {
  407. st->state = MSG_FLOW_FINISHED;
  408. } else {
  409. /* NBIO or error */
  410. goto end;
  411. }
  412. } else {
  413. /* Error */
  414. check_fatal(s);
  415. ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
  416. goto end;
  417. }
  418. }
  419. ret = 1;
  420. end:
  421. st->in_handshake--;
  422. #ifndef OPENSSL_NO_SCTP
  423. if (SSL_IS_DTLS(s) && BIO_dgram_is_sctp(SSL_get_wbio(s))) {
  424. /*
  425. * Notify SCTP BIO socket to leave handshake mode and allow stream
  426. * identifier other than 0.
  427. */
  428. BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_SET_IN_HANDSHAKE,
  429. st->in_handshake, NULL);
  430. }
  431. #endif
  432. BUF_MEM_free(buf);
  433. if (cb != NULL) {
  434. if (server)
  435. cb(s, SSL_CB_ACCEPT_EXIT, ret);
  436. else
  437. cb(s, SSL_CB_CONNECT_EXIT, ret);
  438. }
  439. return ret;
  440. }
  441. /*
  442. * Initialise the MSG_FLOW_READING sub-state machine
  443. */
  444. static void init_read_state_machine(SSL *s)
  445. {
  446. OSSL_STATEM *st = &s->statem;
  447. st->read_state = READ_STATE_HEADER;
  448. }
  449. static int grow_init_buf(SSL *s, size_t size) {
  450. size_t msg_offset = (char *)s->init_msg - s->init_buf->data;
  451. if (!BUF_MEM_grow_clean(s->init_buf, (int)size))
  452. return 0;
  453. if (size < msg_offset)
  454. return 0;
  455. s->init_msg = s->init_buf->data + msg_offset;
  456. return 1;
  457. }
  458. /*
  459. * This function implements the sub-state machine when the message flow is in
  460. * MSG_FLOW_READING. The valid sub-states and transitions are:
  461. *
  462. * READ_STATE_HEADER <--+<-------------+
  463. * | | |
  464. * v | |
  465. * READ_STATE_BODY -----+-->READ_STATE_POST_PROCESS
  466. * | |
  467. * +----------------------------+
  468. * v
  469. * [SUB_STATE_FINISHED]
  470. *
  471. * READ_STATE_HEADER has the responsibility for reading in the message header
  472. * and transitioning the state of the handshake state machine.
  473. *
  474. * READ_STATE_BODY reads in the rest of the message and then subsequently
  475. * processes it.
  476. *
  477. * READ_STATE_POST_PROCESS is an optional step that may occur if some post
  478. * processing activity performed on the message may block.
  479. *
  480. * Any of the above states could result in an NBIO event occurring in which case
  481. * control returns to the calling application. When this function is recalled we
  482. * will resume in the same state where we left off.
  483. */
  484. static SUB_STATE_RETURN read_state_machine(SSL *s)
  485. {
  486. OSSL_STATEM *st = &s->statem;
  487. int ret, mt;
  488. size_t len = 0;
  489. int (*transition) (SSL *s, int mt);
  490. PACKET pkt;
  491. MSG_PROCESS_RETURN(*process_message) (SSL *s, PACKET *pkt);
  492. WORK_STATE(*post_process_message) (SSL *s, WORK_STATE wst);
  493. size_t (*max_message_size) (SSL *s);
  494. void (*cb) (const SSL *ssl, int type, int val) = NULL;
  495. cb = get_callback(s);
  496. if (s->server) {
  497. transition = ossl_statem_server_read_transition;
  498. process_message = ossl_statem_server_process_message;
  499. max_message_size = ossl_statem_server_max_message_size;
  500. post_process_message = ossl_statem_server_post_process_message;
  501. } else {
  502. transition = ossl_statem_client_read_transition;
  503. process_message = ossl_statem_client_process_message;
  504. max_message_size = ossl_statem_client_max_message_size;
  505. post_process_message = ossl_statem_client_post_process_message;
  506. }
  507. if (st->read_state_first_init) {
  508. s->first_packet = 1;
  509. st->read_state_first_init = 0;
  510. }
  511. while (1) {
  512. switch (st->read_state) {
  513. case READ_STATE_HEADER:
  514. /* Get the state the peer wants to move to */
  515. if (SSL_IS_DTLS(s)) {
  516. /*
  517. * In DTLS we get the whole message in one go - header and body
  518. */
  519. ret = dtls_get_message(s, &mt);
  520. } else {
  521. ret = tls_get_message_header(s, &mt);
  522. }
  523. if (ret == 0) {
  524. /* Could be non-blocking IO */
  525. return SUB_STATE_ERROR;
  526. }
  527. if (cb != NULL) {
  528. /* Notify callback of an impending state change */
  529. if (s->server)
  530. cb(s, SSL_CB_ACCEPT_LOOP, 1);
  531. else
  532. cb(s, SSL_CB_CONNECT_LOOP, 1);
  533. }
  534. /*
  535. * Validate that we are allowed to move to the new state and move
  536. * to that state if so
  537. */
  538. if (!transition(s, mt))
  539. return SUB_STATE_ERROR;
  540. if (s->s3.tmp.message_size > max_message_size(s)) {
  541. SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER,
  542. SSL_R_EXCESSIVE_MESSAGE_SIZE);
  543. return SUB_STATE_ERROR;
  544. }
  545. /* dtls_get_message already did this */
  546. if (!SSL_IS_DTLS(s)
  547. && s->s3.tmp.message_size > 0
  548. && !grow_init_buf(s, s->s3.tmp.message_size
  549. + SSL3_HM_HEADER_LENGTH)) {
  550. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_BUF_LIB);
  551. return SUB_STATE_ERROR;
  552. }
  553. st->read_state = READ_STATE_BODY;
  554. /* Fall through */
  555. case READ_STATE_BODY:
  556. if (SSL_IS_DTLS(s)) {
  557. /*
  558. * Actually we already have the body, but we give DTLS the
  559. * opportunity to do any further processing.
  560. */
  561. ret = dtls_get_message_body(s, &len);
  562. } else {
  563. ret = tls_get_message_body(s, &len);
  564. }
  565. if (ret == 0) {
  566. /* Could be non-blocking IO */
  567. return SUB_STATE_ERROR;
  568. }
  569. s->first_packet = 0;
  570. if (!PACKET_buf_init(&pkt, s->init_msg, len)) {
  571. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  572. return SUB_STATE_ERROR;
  573. }
  574. ret = process_message(s, &pkt);
  575. /* Discard the packet data */
  576. s->init_num = 0;
  577. switch (ret) {
  578. case MSG_PROCESS_ERROR:
  579. check_fatal(s);
  580. return SUB_STATE_ERROR;
  581. case MSG_PROCESS_FINISHED_READING:
  582. if (SSL_IS_DTLS(s)) {
  583. dtls1_stop_timer(s);
  584. }
  585. return SUB_STATE_FINISHED;
  586. case MSG_PROCESS_CONTINUE_PROCESSING:
  587. st->read_state = READ_STATE_POST_PROCESS;
  588. st->read_state_work = WORK_MORE_A;
  589. break;
  590. default:
  591. st->read_state = READ_STATE_HEADER;
  592. break;
  593. }
  594. break;
  595. case READ_STATE_POST_PROCESS:
  596. st->read_state_work = post_process_message(s, st->read_state_work);
  597. switch (st->read_state_work) {
  598. case WORK_ERROR:
  599. check_fatal(s);
  600. /* Fall through */
  601. case WORK_MORE_A:
  602. case WORK_MORE_B:
  603. case WORK_MORE_C:
  604. return SUB_STATE_ERROR;
  605. case WORK_FINISHED_CONTINUE:
  606. st->read_state = READ_STATE_HEADER;
  607. break;
  608. case WORK_FINISHED_STOP:
  609. if (SSL_IS_DTLS(s)) {
  610. dtls1_stop_timer(s);
  611. }
  612. return SUB_STATE_FINISHED;
  613. }
  614. break;
  615. default:
  616. /* Shouldn't happen */
  617. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  618. return SUB_STATE_ERROR;
  619. }
  620. }
  621. }
  622. /*
  623. * Send a previously constructed message to the peer.
  624. */
  625. static int statem_do_write(SSL *s)
  626. {
  627. OSSL_STATEM *st = &s->statem;
  628. if (st->hand_state == TLS_ST_CW_CHANGE
  629. || st->hand_state == TLS_ST_SW_CHANGE) {
  630. if (SSL_IS_DTLS(s))
  631. return dtls1_do_write(s, SSL3_RT_CHANGE_CIPHER_SPEC);
  632. else
  633. return ssl3_do_write(s, SSL3_RT_CHANGE_CIPHER_SPEC);
  634. } else {
  635. return ssl_do_write(s);
  636. }
  637. }
  638. /*
  639. * Initialise the MSG_FLOW_WRITING sub-state machine
  640. */
  641. static void init_write_state_machine(SSL *s)
  642. {
  643. OSSL_STATEM *st = &s->statem;
  644. st->write_state = WRITE_STATE_TRANSITION;
  645. }
  646. /*
  647. * This function implements the sub-state machine when the message flow is in
  648. * MSG_FLOW_WRITING. The valid sub-states and transitions are:
  649. *
  650. * +-> WRITE_STATE_TRANSITION ------> [SUB_STATE_FINISHED]
  651. * | |
  652. * | v
  653. * | WRITE_STATE_PRE_WORK -----> [SUB_STATE_END_HANDSHAKE]
  654. * | |
  655. * | v
  656. * | WRITE_STATE_SEND
  657. * | |
  658. * | v
  659. * | WRITE_STATE_POST_WORK
  660. * | |
  661. * +-------------+
  662. *
  663. * WRITE_STATE_TRANSITION transitions the state of the handshake state machine
  664. * WRITE_STATE_PRE_WORK performs any work necessary to prepare the later
  665. * sending of the message. This could result in an NBIO event occurring in
  666. * which case control returns to the calling application. When this function
  667. * is recalled we will resume in the same state where we left off.
  668. *
  669. * WRITE_STATE_SEND sends the message and performs any work to be done after
  670. * sending.
  671. *
  672. * WRITE_STATE_POST_WORK performs any work necessary after the sending of the
  673. * message has been completed. As for WRITE_STATE_PRE_WORK this could also
  674. * result in an NBIO event.
  675. */
  676. static SUB_STATE_RETURN write_state_machine(SSL *s)
  677. {
  678. OSSL_STATEM *st = &s->statem;
  679. int ret;
  680. WRITE_TRAN(*transition) (SSL *s);
  681. WORK_STATE(*pre_work) (SSL *s, WORK_STATE wst);
  682. WORK_STATE(*post_work) (SSL *s, WORK_STATE wst);
  683. int (*get_construct_message_f) (SSL *s,
  684. int (**confunc) (SSL *s, WPACKET *pkt),
  685. int *mt);
  686. void (*cb) (const SSL *ssl, int type, int val) = NULL;
  687. int (*confunc) (SSL *s, WPACKET *pkt);
  688. int mt;
  689. WPACKET pkt;
  690. cb = get_callback(s);
  691. if (s->server) {
  692. transition = ossl_statem_server_write_transition;
  693. pre_work = ossl_statem_server_pre_work;
  694. post_work = ossl_statem_server_post_work;
  695. get_construct_message_f = ossl_statem_server_construct_message;
  696. } else {
  697. transition = ossl_statem_client_write_transition;
  698. pre_work = ossl_statem_client_pre_work;
  699. post_work = ossl_statem_client_post_work;
  700. get_construct_message_f = ossl_statem_client_construct_message;
  701. }
  702. while (1) {
  703. switch (st->write_state) {
  704. case WRITE_STATE_TRANSITION:
  705. if (cb != NULL) {
  706. /* Notify callback of an impending state change */
  707. if (s->server)
  708. cb(s, SSL_CB_ACCEPT_LOOP, 1);
  709. else
  710. cb(s, SSL_CB_CONNECT_LOOP, 1);
  711. }
  712. switch (transition(s)) {
  713. case WRITE_TRAN_CONTINUE:
  714. st->write_state = WRITE_STATE_PRE_WORK;
  715. st->write_state_work = WORK_MORE_A;
  716. break;
  717. case WRITE_TRAN_FINISHED:
  718. return SUB_STATE_FINISHED;
  719. break;
  720. case WRITE_TRAN_ERROR:
  721. check_fatal(s);
  722. return SUB_STATE_ERROR;
  723. }
  724. break;
  725. case WRITE_STATE_PRE_WORK:
  726. switch (st->write_state_work = pre_work(s, st->write_state_work)) {
  727. case WORK_ERROR:
  728. check_fatal(s);
  729. /* Fall through */
  730. case WORK_MORE_A:
  731. case WORK_MORE_B:
  732. case WORK_MORE_C:
  733. return SUB_STATE_ERROR;
  734. case WORK_FINISHED_CONTINUE:
  735. st->write_state = WRITE_STATE_SEND;
  736. break;
  737. case WORK_FINISHED_STOP:
  738. return SUB_STATE_END_HANDSHAKE;
  739. }
  740. if (!get_construct_message_f(s, &confunc, &mt)) {
  741. /* SSLfatal() already called */
  742. return SUB_STATE_ERROR;
  743. }
  744. if (mt == SSL3_MT_DUMMY) {
  745. /* Skip construction and sending. This isn't a "real" state */
  746. st->write_state = WRITE_STATE_POST_WORK;
  747. st->write_state_work = WORK_MORE_A;
  748. break;
  749. }
  750. if (!WPACKET_init(&pkt, s->init_buf)
  751. || !ssl_set_handshake_header(s, &pkt, mt)) {
  752. WPACKET_cleanup(&pkt);
  753. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  754. return SUB_STATE_ERROR;
  755. }
  756. if (confunc != NULL && !confunc(s, &pkt)) {
  757. WPACKET_cleanup(&pkt);
  758. check_fatal(s);
  759. return SUB_STATE_ERROR;
  760. }
  761. if (!ssl_close_construct_packet(s, &pkt, mt)
  762. || !WPACKET_finish(&pkt)) {
  763. WPACKET_cleanup(&pkt);
  764. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  765. return SUB_STATE_ERROR;
  766. }
  767. /* Fall through */
  768. case WRITE_STATE_SEND:
  769. if (SSL_IS_DTLS(s) && st->use_timer) {
  770. dtls1_start_timer(s);
  771. }
  772. ret = statem_do_write(s);
  773. if (ret <= 0) {
  774. return SUB_STATE_ERROR;
  775. }
  776. st->write_state = WRITE_STATE_POST_WORK;
  777. st->write_state_work = WORK_MORE_A;
  778. /* Fall through */
  779. case WRITE_STATE_POST_WORK:
  780. switch (st->write_state_work = post_work(s, st->write_state_work)) {
  781. case WORK_ERROR:
  782. check_fatal(s);
  783. /* Fall through */
  784. case WORK_MORE_A:
  785. case WORK_MORE_B:
  786. case WORK_MORE_C:
  787. return SUB_STATE_ERROR;
  788. case WORK_FINISHED_CONTINUE:
  789. st->write_state = WRITE_STATE_TRANSITION;
  790. break;
  791. case WORK_FINISHED_STOP:
  792. return SUB_STATE_END_HANDSHAKE;
  793. }
  794. break;
  795. default:
  796. SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
  797. return SUB_STATE_ERROR;
  798. }
  799. }
  800. }
  801. /*
  802. * Flush the write BIO
  803. */
  804. int statem_flush(SSL *s)
  805. {
  806. s->rwstate = SSL_WRITING;
  807. if (BIO_flush(s->wbio) <= 0) {
  808. return 0;
  809. }
  810. s->rwstate = SSL_NOTHING;
  811. return 1;
  812. }
  813. /*
  814. * Called by the record layer to determine whether application data is
  815. * allowed to be received in the current handshake state or not.
  816. *
  817. * Return values are:
  818. * 1: Yes (application data allowed)
  819. * 0: No (application data not allowed)
  820. */
  821. int ossl_statem_app_data_allowed(SSL *s)
  822. {
  823. OSSL_STATEM *st = &s->statem;
  824. if (st->state == MSG_FLOW_UNINITED)
  825. return 0;
  826. if (!s->s3.in_read_app_data || (s->s3.total_renegotiations == 0))
  827. return 0;
  828. if (s->server) {
  829. /*
  830. * If we're a server and we haven't got as far as writing our
  831. * ServerHello yet then we allow app data
  832. */
  833. if (st->hand_state == TLS_ST_BEFORE
  834. || st->hand_state == TLS_ST_SR_CLNT_HELLO)
  835. return 1;
  836. } else {
  837. /*
  838. * If we're a client and we haven't read the ServerHello yet then we
  839. * allow app data
  840. */
  841. if (st->hand_state == TLS_ST_CW_CLNT_HELLO)
  842. return 1;
  843. }
  844. return 0;
  845. }
  846. /*
  847. * This function returns 1 if TLS exporter is ready to export keying
  848. * material, or 0 if otherwise.
  849. */
  850. int ossl_statem_export_allowed(SSL *s)
  851. {
  852. return s->s3.previous_server_finished_len != 0
  853. && s->statem.hand_state != TLS_ST_SW_FINISHED;
  854. }
  855. /*
  856. * Return 1 if early TLS exporter is ready to export keying material,
  857. * or 0 if otherwise.
  858. */
  859. int ossl_statem_export_early_allowed(SSL *s)
  860. {
  861. /*
  862. * The early exporter secret is only present on the server if we
  863. * have accepted early_data. It is present on the client as long
  864. * as we have sent early_data.
  865. */
  866. return s->ext.early_data == SSL_EARLY_DATA_ACCEPTED
  867. || (!s->server && s->ext.early_data != SSL_EARLY_DATA_NOT_SENT);
  868. }