12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162 |
- /*
- * Copyright 2022-2024 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License"). You may not use
- * this file except in compliance with the License. You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
- #include <assert.h>
- #include <openssl/bio.h>
- #include <openssl/ssl.h>
- #include <openssl/err.h>
- #include <openssl/core_names.h>
- #include <openssl/comp.h>
- #include <openssl/ssl.h>
- #include "internal/e_os.h"
- #include "internal/packet.h"
- #include "internal/ssl3_cbc.h"
- #include "../../ssl_local.h"
- #include "../record_local.h"
- #include "recmethod_local.h"
- static void tls_int_free(OSSL_RECORD_LAYER *rl);
- void ossl_tls_buffer_release(TLS_BUFFER *b)
- {
- OPENSSL_free(b->buf);
- b->buf = NULL;
- }
- static void TLS_RL_RECORD_release(TLS_RL_RECORD *r, size_t num_recs)
- {
- size_t i;
- for (i = 0; i < num_recs; i++) {
- OPENSSL_free(r[i].comp);
- r[i].comp = NULL;
- }
- }
- void ossl_tls_rl_record_set_seq_num(TLS_RL_RECORD *r,
- const unsigned char *seq_num)
- {
- memcpy(r->seq_num, seq_num, SEQ_NUM_SIZE);
- }
- void ossl_rlayer_fatal(OSSL_RECORD_LAYER *rl, int al, int reason,
- const char *fmt, ...)
- {
- va_list args;
- va_start(args, fmt);
- ERR_vset_error(ERR_LIB_SSL, reason, fmt, args);
- va_end(args);
- rl->alert = al;
- }
- int ossl_set_tls_provider_parameters(OSSL_RECORD_LAYER *rl,
- EVP_CIPHER_CTX *ctx,
- const EVP_CIPHER *ciph,
- const EVP_MD *md)
- {
- /*
- * Provided cipher, the TLS padding/MAC removal is performed provider
- * side so we need to tell the ctx about our TLS version and mac size
- */
- OSSL_PARAM params[3], *pprm = params;
- size_t macsize = 0;
- int imacsize = -1;
- if ((EVP_CIPHER_get_flags(ciph) & EVP_CIPH_FLAG_AEAD_CIPHER) == 0
- && !rl->use_etm)
- imacsize = EVP_MD_get_size(md);
- if (imacsize >= 0)
- macsize = (size_t)imacsize;
- *pprm++ = OSSL_PARAM_construct_int(OSSL_CIPHER_PARAM_TLS_VERSION,
- &rl->version);
- *pprm++ = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_TLS_MAC_SIZE,
- &macsize);
- *pprm = OSSL_PARAM_construct_end();
- if (!EVP_CIPHER_CTX_set_params(ctx, params)) {
- ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
- return 0;
- }
- return 1;
- }
- /*
- * ssl3_cbc_record_digest_supported returns 1 iff |ctx| uses a hash function
- * which ssl3_cbc_digest_record supports.
- */
- char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
- {
- switch (EVP_MD_CTX_get_type(ctx)) {
- case NID_md5:
- case NID_sha1:
- case NID_sha224:
- case NID_sha256:
- case NID_sha384:
- case NID_sha512:
- return 1;
- default:
- return 0;
- }
- }
- #ifndef OPENSSL_NO_COMP
- static int tls_allow_compression(OSSL_RECORD_LAYER *rl)
- {
- if (rl->options & SSL_OP_NO_COMPRESSION)
- return 0;
- return rl->security == NULL
- || rl->security(rl->cbarg, SSL_SECOP_COMPRESSION, 0, 0, NULL);
- }
- #endif
- static void tls_release_write_buffer_int(OSSL_RECORD_LAYER *rl, size_t start)
- {
- TLS_BUFFER *wb;
- size_t pipes;
- pipes = rl->numwpipes;
- while (pipes > start) {
- wb = &rl->wbuf[pipes - 1];
- if (TLS_BUFFER_is_app_buffer(wb))
- TLS_BUFFER_set_app_buffer(wb, 0);
- else
- OPENSSL_free(wb->buf);
- wb->buf = NULL;
- pipes--;
- }
- }
- int tls_setup_write_buffer(OSSL_RECORD_LAYER *rl, size_t numwpipes,
- size_t firstlen, size_t nextlen)
- {
- unsigned char *p;
- size_t align = 0, headerlen;
- TLS_BUFFER *wb;
- size_t currpipe;
- size_t defltlen = 0;
- size_t contenttypelen = 0;
- if (firstlen == 0 || (numwpipes > 1 && nextlen == 0)) {
- if (rl->isdtls)
- headerlen = DTLS1_RT_HEADER_LENGTH + 1;
- else
- headerlen = SSL3_RT_HEADER_LENGTH;
- /* TLSv1.3 adds an extra content type byte after payload data */
- if (rl->version == TLS1_3_VERSION)
- contenttypelen = 1;
- #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD != 0
- align = SSL3_ALIGN_PAYLOAD - 1;
- #endif
- defltlen = align + headerlen + rl->eivlen + rl->max_frag_len
- + contenttypelen + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD;
- #ifndef OPENSSL_NO_COMP
- if (tls_allow_compression(rl))
- defltlen += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
- #endif
- /*
- * We don't need to add eivlen here since empty fragments only occur
- * when we don't have an explicit IV. The contenttype byte will also
- * always be 0 in these protocol versions
- */
- if ((rl->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) == 0)
- defltlen += headerlen + align + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD;
- }
- wb = rl->wbuf;
- for (currpipe = 0; currpipe < numwpipes; currpipe++) {
- TLS_BUFFER *thiswb = &wb[currpipe];
- size_t len = (currpipe == 0) ? firstlen : nextlen;
- if (len == 0)
- len = defltlen;
- if (thiswb->len != len) {
- OPENSSL_free(thiswb->buf);
- thiswb->buf = NULL; /* force reallocation */
- }
- p = thiswb->buf;
- if (p == NULL) {
- p = OPENSSL_malloc(len);
- if (p == NULL) {
- if (rl->numwpipes < currpipe)
- rl->numwpipes = currpipe;
- /*
- * We've got a malloc failure, and we're still initialising
- * buffers. We assume we're so doomed that we won't even be able
- * to send an alert.
- */
- RLAYERfatal(rl, SSL_AD_NO_ALERT, ERR_R_CRYPTO_LIB);
- return 0;
- }
- }
- memset(thiswb, 0, sizeof(TLS_BUFFER));
- thiswb->buf = p;
- thiswb->len = len;
- }
- /* Free any previously allocated buffers that we are no longer using */
- tls_release_write_buffer_int(rl, currpipe);
- rl->numwpipes = numwpipes;
- return 1;
- }
- static void tls_release_write_buffer(OSSL_RECORD_LAYER *rl)
- {
- tls_release_write_buffer_int(rl, 0);
- rl->numwpipes = 0;
- }
- int tls_setup_read_buffer(OSSL_RECORD_LAYER *rl)
- {
- unsigned char *p;
- size_t len, align = 0, headerlen;
- TLS_BUFFER *b;
- b = &rl->rbuf;
- if (rl->isdtls)
- headerlen = DTLS1_RT_HEADER_LENGTH;
- else
- headerlen = SSL3_RT_HEADER_LENGTH;
- #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD != 0
- align = (-SSL3_RT_HEADER_LENGTH) & (SSL3_ALIGN_PAYLOAD - 1);
- #endif
- if (b->buf == NULL) {
- len = rl->max_frag_len
- + SSL3_RT_MAX_ENCRYPTED_OVERHEAD + headerlen + align;
- #ifndef OPENSSL_NO_COMP
- if (tls_allow_compression(rl))
- len += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
- #endif
- /* Ensure our buffer is large enough to support all our pipelines */
- if (rl->max_pipelines > 1)
- len *= rl->max_pipelines;
- if (b->default_len > len)
- len = b->default_len;
- if ((p = OPENSSL_malloc(len)) == NULL) {
- /*
- * We've got a malloc failure, and we're still initialising buffers.
- * We assume we're so doomed that we won't even be able to send an
- * alert.
- */
- RLAYERfatal(rl, SSL_AD_NO_ALERT, ERR_R_CRYPTO_LIB);
- return 0;
- }
- b->buf = p;
- b->len = len;
- }
- return 1;
- }
- static int tls_release_read_buffer(OSSL_RECORD_LAYER *rl)
- {
- TLS_BUFFER *b;
- b = &rl->rbuf;
- if ((rl->options & SSL_OP_CLEANSE_PLAINTEXT) != 0)
- OPENSSL_cleanse(b->buf, b->len);
- OPENSSL_free(b->buf);
- b->buf = NULL;
- return 1;
- }
- /*
- * Return values are as per SSL_read()
- */
- int tls_default_read_n(OSSL_RECORD_LAYER *rl, size_t n, size_t max, int extend,
- int clearold, size_t *readbytes)
- {
- /*
- * If extend == 0, obtain new n-byte packet; if extend == 1, increase
- * packet by another n bytes. The packet will be in the sub-array of
- * rl->rbuf.buf specified by rl->packet and rl->packet_length. (If
- * rl->read_ahead is set, 'max' bytes may be stored in rbuf [plus
- * rl->packet_length bytes if extend == 1].) if clearold == 1, move the
- * packet to the start of the buffer; if clearold == 0 then leave any old
- * packets where they were
- */
- size_t len, left, align = 0;
- unsigned char *pkt;
- TLS_BUFFER *rb;
- if (n == 0)
- return OSSL_RECORD_RETURN_NON_FATAL_ERR;
- rb = &rl->rbuf;
- left = rb->left;
- #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD != 0
- align = (size_t)rb->buf + SSL3_RT_HEADER_LENGTH;
- align = SSL3_ALIGN_PAYLOAD - 1 - ((align - 1) % SSL3_ALIGN_PAYLOAD);
- #endif
- if (!extend) {
- /* start with empty packet ... */
- if (left == 0)
- rb->offset = align;
- rl->packet = rb->buf + rb->offset;
- rl->packet_length = 0;
- /* ... now we can act as if 'extend' was set */
- }
- len = rl->packet_length;
- pkt = rb->buf + align;
- /*
- * Move any available bytes to front of buffer: 'len' bytes already
- * pointed to by 'packet', 'left' extra ones at the end
- */
- if (rl->packet != pkt && clearold == 1) {
- memmove(pkt, rl->packet, len + left);
- rl->packet = pkt;
- rb->offset = len + align;
- }
- /*
- * For DTLS/UDP reads should not span multiple packets because the read
- * operation returns the whole packet at once (as long as it fits into
- * the buffer).
- */
- if (rl->isdtls) {
- if (left == 0 && extend) {
- /*
- * We received a record with a header but no body data. This will
- * get dumped.
- */
- return OSSL_RECORD_RETURN_NON_FATAL_ERR;
- }
- if (left > 0 && n > left)
- n = left;
- }
- /* if there is enough in the buffer from a previous read, take some */
- if (left >= n) {
- rl->packet_length += n;
- rb->left = left - n;
- rb->offset += n;
- *readbytes = n;
- return OSSL_RECORD_RETURN_SUCCESS;
- }
- /* else we need to read more data */
- if (n > rb->len - rb->offset) {
- /* does not happen */
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
- return OSSL_RECORD_RETURN_FATAL;
- }
- /* We always act like read_ahead is set for DTLS */
- if (!rl->read_ahead && !rl->isdtls) {
- /* ignore max parameter */
- max = n;
- } else {
- if (max < n)
- max = n;
- if (max > rb->len - rb->offset)
- max = rb->len - rb->offset;
- }
- while (left < n) {
- size_t bioread = 0;
- int ret;
- BIO *bio = rl->prev != NULL ? rl->prev : rl->bio;
- /*
- * Now we have len+left bytes at the front of rl->rbuf.buf and
- * need to read in more until we have len + n (up to len + max if
- * possible)
- */
- clear_sys_error();
- if (bio != NULL) {
- ret = BIO_read(bio, pkt + len + left, max - left);
- if (ret > 0) {
- bioread = ret;
- ret = OSSL_RECORD_RETURN_SUCCESS;
- } else if (BIO_should_retry(bio)) {
- if (rl->prev != NULL) {
- /*
- * We were reading from the previous epoch. Now there is no
- * more data, so swap to the actual transport BIO
- */
- BIO_free(rl->prev);
- rl->prev = NULL;
- continue;
- }
- ret = OSSL_RECORD_RETURN_RETRY;
- } else if (BIO_eof(bio)) {
- ret = OSSL_RECORD_RETURN_EOF;
- } else {
- ret = OSSL_RECORD_RETURN_FATAL;
- }
- } else {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, SSL_R_READ_BIO_NOT_SET);
- ret = OSSL_RECORD_RETURN_FATAL;
- }
- if (ret <= OSSL_RECORD_RETURN_RETRY) {
- rb->left = left;
- if ((rl->mode & SSL_MODE_RELEASE_BUFFERS) != 0 && !rl->isdtls)
- if (len + left == 0)
- tls_release_read_buffer(rl);
- return ret;
- }
- left += bioread;
- /*
- * reads should *never* span multiple packets for DTLS because the
- * underlying transport protocol is message oriented as opposed to
- * byte oriented as in the TLS case.
- */
- if (rl->isdtls) {
- if (n > left)
- n = left; /* makes the while condition false */
- }
- }
- /* done reading, now the book-keeping */
- rb->offset += n;
- rb->left = left - n;
- rl->packet_length += n;
- *readbytes = n;
- return OSSL_RECORD_RETURN_SUCCESS;
- }
- /*
- * Peeks ahead into "read_ahead" data to see if we have a whole record waiting
- * for us in the buffer.
- */
- static int tls_record_app_data_waiting(OSSL_RECORD_LAYER *rl)
- {
- TLS_BUFFER *rbuf;
- size_t left, len;
- unsigned char *p;
- rbuf = &rl->rbuf;
- p = TLS_BUFFER_get_buf(rbuf);
- if (p == NULL)
- return 0;
- left = TLS_BUFFER_get_left(rbuf);
- if (left < SSL3_RT_HEADER_LENGTH)
- return 0;
- p += TLS_BUFFER_get_offset(rbuf);
- /*
- * We only check the type and record length, we will sanity check version
- * etc later
- */
- if (*p != SSL3_RT_APPLICATION_DATA)
- return 0;
- p += 3;
- n2s(p, len);
- if (left < SSL3_RT_HEADER_LENGTH + len)
- return 0;
- return 1;
- }
- static int rlayer_early_data_count_ok(OSSL_RECORD_LAYER *rl, size_t length,
- size_t overhead, int send)
- {
- uint32_t max_early_data = rl->max_early_data;
- if (max_early_data == 0) {
- RLAYERfatal(rl, send ? SSL_AD_INTERNAL_ERROR : SSL_AD_UNEXPECTED_MESSAGE,
- SSL_R_TOO_MUCH_EARLY_DATA);
- return 0;
- }
- /* If we are dealing with ciphertext we need to allow for the overhead */
- max_early_data += overhead;
- if (rl->early_data_count + length > max_early_data) {
- RLAYERfatal(rl, send ? SSL_AD_INTERNAL_ERROR : SSL_AD_UNEXPECTED_MESSAGE,
- SSL_R_TOO_MUCH_EARLY_DATA);
- return 0;
- }
- rl->early_data_count += length;
- return 1;
- }
- /*
- * MAX_EMPTY_RECORDS defines the number of consecutive, empty records that
- * will be processed per call to tls_get_more_records. Without this limit an
- * attacker could send empty records at a faster rate than we can process and
- * cause tls_get_more_records to loop forever.
- */
- #define MAX_EMPTY_RECORDS 32
- #define SSL2_RT_HEADER_LENGTH 2
- /*-
- * Call this to buffer new input records in rl->rrec.
- * It will return a OSSL_RECORD_RETURN_* value.
- * When it finishes successfully (OSSL_RECORD_RETURN_SUCCESS), |rl->num_recs|
- * records have been decoded. For each record 'i':
- * rrec[i].type - is the type of record
- * rrec[i].data, - data
- * rrec[i].length, - number of bytes
- * Multiple records will only be returned if the record types are all
- * SSL3_RT_APPLICATION_DATA. The number of records returned will always be <=
- * |max_pipelines|
- */
- int tls_get_more_records(OSSL_RECORD_LAYER *rl)
- {
- int enc_err, rret;
- int i;
- size_t more, n;
- TLS_RL_RECORD *rr, *thisrr;
- TLS_BUFFER *rbuf;
- unsigned char *p;
- unsigned char md[EVP_MAX_MD_SIZE];
- unsigned int version;
- size_t mac_size = 0;
- int imac_size;
- size_t num_recs = 0, max_recs, j;
- PACKET pkt, sslv2pkt;
- SSL_MAC_BUF *macbufs = NULL;
- int ret = OSSL_RECORD_RETURN_FATAL;
- rr = rl->rrec;
- rbuf = &rl->rbuf;
- if (rbuf->buf == NULL) {
- if (!tls_setup_read_buffer(rl)) {
- /* RLAYERfatal() already called */
- return OSSL_RECORD_RETURN_FATAL;
- }
- }
- max_recs = rl->max_pipelines;
- if (max_recs == 0)
- max_recs = 1;
- do {
- thisrr = &rr[num_recs];
- /* check if we have the header */
- if ((rl->rstate != SSL_ST_READ_BODY) ||
- (rl->packet_length < SSL3_RT_HEADER_LENGTH)) {
- size_t sslv2len;
- unsigned int type;
- rret = rl->funcs->read_n(rl, SSL3_RT_HEADER_LENGTH,
- TLS_BUFFER_get_len(rbuf), 0,
- num_recs == 0 ? 1 : 0, &n);
- if (rret < OSSL_RECORD_RETURN_SUCCESS)
- return rret; /* error or non-blocking */
- rl->rstate = SSL_ST_READ_BODY;
- p = rl->packet;
- if (!PACKET_buf_init(&pkt, p, rl->packet_length)) {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
- return OSSL_RECORD_RETURN_FATAL;
- }
- sslv2pkt = pkt;
- if (!PACKET_get_net_2_len(&sslv2pkt, &sslv2len)
- || !PACKET_get_1(&sslv2pkt, &type)) {
- RLAYERfatal(rl, SSL_AD_DECODE_ERROR, ERR_R_INTERNAL_ERROR);
- return OSSL_RECORD_RETURN_FATAL;
- }
- /*
- * The first record received by the server may be a V2ClientHello.
- */
- if (rl->role == OSSL_RECORD_ROLE_SERVER
- && rl->is_first_record
- && (sslv2len & 0x8000) != 0
- && (type == SSL2_MT_CLIENT_HELLO)) {
- /*
- * SSLv2 style record
- *
- * |num_recs| here will actually always be 0 because
- * |num_recs > 0| only ever occurs when we are processing
- * multiple app data records - which we know isn't the case here
- * because it is an SSLv2ClientHello. We keep it using
- * |num_recs| for the sake of consistency
- */
- thisrr->type = SSL3_RT_HANDSHAKE;
- thisrr->rec_version = SSL2_VERSION;
- thisrr->length = sslv2len & 0x7fff;
- if (thisrr->length > TLS_BUFFER_get_len(rbuf)
- - SSL2_RT_HEADER_LENGTH) {
- RLAYERfatal(rl, SSL_AD_RECORD_OVERFLOW,
- SSL_R_PACKET_LENGTH_TOO_LONG);
- return OSSL_RECORD_RETURN_FATAL;
- }
- } else {
- /* SSLv3+ style record */
- /* Pull apart the header into the TLS_RL_RECORD */
- if (!PACKET_get_1(&pkt, &type)
- || !PACKET_get_net_2(&pkt, &version)
- || !PACKET_get_net_2_len(&pkt, &thisrr->length)) {
- if (rl->msg_callback != NULL)
- rl->msg_callback(0, 0, SSL3_RT_HEADER, p, 5, rl->cbarg);
- RLAYERfatal(rl, SSL_AD_DECODE_ERROR, ERR_R_INTERNAL_ERROR);
- return OSSL_RECORD_RETURN_FATAL;
- }
- thisrr->type = type;
- thisrr->rec_version = version;
- /*
- * When we call validate_record_header() only records actually
- * received in SSLv2 format should have the record version set
- * to SSL2_VERSION. This way validate_record_header() can know
- * what format the record was in based on the version.
- */
- if (thisrr->rec_version == SSL2_VERSION) {
- RLAYERfatal(rl, SSL_AD_PROTOCOL_VERSION,
- SSL_R_WRONG_VERSION_NUMBER);
- return OSSL_RECORD_RETURN_FATAL;
- }
- if (rl->msg_callback != NULL)
- rl->msg_callback(0, version, SSL3_RT_HEADER, p, 5, rl->cbarg);
- if (thisrr->length >
- TLS_BUFFER_get_len(rbuf) - SSL3_RT_HEADER_LENGTH) {
- RLAYERfatal(rl, SSL_AD_RECORD_OVERFLOW,
- SSL_R_PACKET_LENGTH_TOO_LONG);
- return OSSL_RECORD_RETURN_FATAL;
- }
- }
- if (!rl->funcs->validate_record_header(rl, thisrr)) {
- /* RLAYERfatal already called */
- return OSSL_RECORD_RETURN_FATAL;
- }
- /* now rl->rstate == SSL_ST_READ_BODY */
- }
- /*
- * rl->rstate == SSL_ST_READ_BODY, get and decode the data. Calculate
- * how much more data we need to read for the rest of the record
- */
- if (thisrr->rec_version == SSL2_VERSION) {
- more = thisrr->length + SSL2_RT_HEADER_LENGTH
- - SSL3_RT_HEADER_LENGTH;
- } else {
- more = thisrr->length;
- }
- if (more > 0) {
- /* now rl->packet_length == SSL3_RT_HEADER_LENGTH */
- rret = rl->funcs->read_n(rl, more, more, 1, 0, &n);
- if (rret < OSSL_RECORD_RETURN_SUCCESS)
- return rret; /* error or non-blocking io */
- }
- /* set state for later operations */
- rl->rstate = SSL_ST_READ_HEADER;
- /*
- * At this point, rl->packet_length == SSL3_RT_HEADER_LENGTH
- * + thisrr->length, or rl->packet_length == SSL2_RT_HEADER_LENGTH
- * + thisrr->length and we have that many bytes in rl->packet
- */
- if (thisrr->rec_version == SSL2_VERSION)
- thisrr->input = &(rl->packet[SSL2_RT_HEADER_LENGTH]);
- else
- thisrr->input = &(rl->packet[SSL3_RT_HEADER_LENGTH]);
- /*
- * ok, we can now read from 'rl->packet' data into 'thisrr'.
- * thisrr->input points at thisrr->length bytes, which need to be copied
- * into thisrr->data by either the decryption or by the decompression.
- * When the data is 'copied' into the thisrr->data buffer,
- * thisrr->input will be updated to point at the new buffer
- */
- /*
- * We now have - encrypted [ MAC [ compressed [ plain ] ] ]
- * thisrr->length bytes of encrypted compressed stuff.
- */
- /* decrypt in place in 'thisrr->input' */
- thisrr->data = thisrr->input;
- thisrr->orig_len = thisrr->length;
- num_recs++;
- /* we have pulled in a full packet so zero things */
- rl->packet_length = 0;
- rl->is_first_record = 0;
- } while (num_recs < max_recs
- && thisrr->type == SSL3_RT_APPLICATION_DATA
- && RLAYER_USE_EXPLICIT_IV(rl)
- && rl->enc_ctx != NULL
- && (EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(rl->enc_ctx))
- & EVP_CIPH_FLAG_PIPELINE) != 0
- && tls_record_app_data_waiting(rl));
- if (num_recs == 1
- && thisrr->type == SSL3_RT_CHANGE_CIPHER_SPEC
- /* The following can happen in tlsany_meth after HRR */
- && rl->version == TLS1_3_VERSION
- && rl->is_first_handshake) {
- /*
- * CCS messages must be exactly 1 byte long, containing the value 0x01
- */
- if (thisrr->length != 1 || thisrr->data[0] != 0x01) {
- RLAYERfatal(rl, SSL_AD_ILLEGAL_PARAMETER,
- SSL_R_INVALID_CCS_MESSAGE);
- return OSSL_RECORD_RETURN_FATAL;
- }
- /*
- * CCS messages are ignored in TLSv1.3. We treat it like an empty
- * handshake record
- */
- thisrr->type = SSL3_RT_HANDSHAKE;
- if (++(rl->empty_record_count) > MAX_EMPTY_RECORDS) {
- RLAYERfatal(rl, SSL_AD_UNEXPECTED_MESSAGE,
- SSL_R_UNEXPECTED_CCS_MESSAGE);
- return OSSL_RECORD_RETURN_FATAL;
- }
- rl->num_recs = 0;
- rl->curr_rec = 0;
- rl->num_released = 0;
- return OSSL_RECORD_RETURN_SUCCESS;
- }
- if (rl->md_ctx != NULL) {
- const EVP_MD *tmpmd = EVP_MD_CTX_get0_md(rl->md_ctx);
- if (tmpmd != NULL) {
- imac_size = EVP_MD_get_size(tmpmd);
- if (!ossl_assert(imac_size >= 0 && imac_size <= EVP_MAX_MD_SIZE)) {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
- return OSSL_RECORD_RETURN_FATAL;
- }
- mac_size = (size_t)imac_size;
- }
- }
- /*
- * If in encrypt-then-mac mode calculate mac from encrypted record. All
- * the details below are public so no timing details can leak.
- */
- if (rl->use_etm && rl->md_ctx != NULL) {
- unsigned char *mac;
- for (j = 0; j < num_recs; j++) {
- thisrr = &rr[j];
- if (thisrr->length < mac_size) {
- RLAYERfatal(rl, SSL_AD_DECODE_ERROR, SSL_R_LENGTH_TOO_SHORT);
- return OSSL_RECORD_RETURN_FATAL;
- }
- thisrr->length -= mac_size;
- mac = thisrr->data + thisrr->length;
- i = rl->funcs->mac(rl, thisrr, md, 0 /* not send */);
- if (i == 0 || CRYPTO_memcmp(md, mac, mac_size) != 0) {
- RLAYERfatal(rl, SSL_AD_BAD_RECORD_MAC,
- SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
- return OSSL_RECORD_RETURN_FATAL;
- }
- }
- /*
- * We've handled the mac now - there is no MAC inside the encrypted
- * record
- */
- mac_size = 0;
- }
- if (mac_size > 0) {
- macbufs = OPENSSL_zalloc(sizeof(*macbufs) * num_recs);
- if (macbufs == NULL) {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_CRYPTO_LIB);
- return OSSL_RECORD_RETURN_FATAL;
- }
- }
- ERR_set_mark();
- enc_err = rl->funcs->cipher(rl, rr, num_recs, 0, macbufs, mac_size);
- /*-
- * enc_err is:
- * 0: if the record is publicly invalid, or an internal error, or AEAD
- * decryption failed, or ETM decryption failed.
- * 1: Success or MTE decryption failed (MAC will be randomised)
- */
- if (enc_err == 0) {
- if (rl->alert != SSL_AD_NO_ALERT) {
- /* RLAYERfatal() already got called */
- ERR_clear_last_mark();
- goto end;
- }
- if (num_recs == 1
- && rl->skip_early_data != NULL
- && rl->skip_early_data(rl->cbarg)) {
- /*
- * Valid early_data that we cannot decrypt will fail here. We treat
- * it like an empty record.
- */
- /*
- * Remove any errors from the stack. Decryption failures are normal
- * behaviour.
- */
- ERR_pop_to_mark();
- thisrr = &rr[0];
- if (!rlayer_early_data_count_ok(rl, thisrr->length,
- EARLY_DATA_CIPHERTEXT_OVERHEAD, 0)) {
- /* RLAYERfatal() already called */
- goto end;
- }
- thisrr->length = 0;
- rl->num_recs = 0;
- rl->curr_rec = 0;
- rl->num_released = 0;
- /* Reset the read sequence */
- memset(rl->sequence, 0, sizeof(rl->sequence));
- ret = 1;
- goto end;
- }
- ERR_clear_last_mark();
- RLAYERfatal(rl, SSL_AD_BAD_RECORD_MAC,
- SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
- goto end;
- } else {
- ERR_clear_last_mark();
- }
- OSSL_TRACE_BEGIN(TLS) {
- BIO_printf(trc_out, "dec %lu\n", (unsigned long)rr[0].length);
- BIO_dump_indent(trc_out, rr[0].data, rr[0].length, 4);
- } OSSL_TRACE_END(TLS);
- /* r->length is now the compressed data plus mac */
- if (rl->enc_ctx != NULL
- && !rl->use_etm
- && EVP_MD_CTX_get0_md(rl->md_ctx) != NULL) {
- for (j = 0; j < num_recs; j++) {
- SSL_MAC_BUF *thismb = &macbufs[j];
- thisrr = &rr[j];
- i = rl->funcs->mac(rl, thisrr, md, 0 /* not send */);
- if (i == 0 || thismb == NULL || thismb->mac == NULL
- || CRYPTO_memcmp(md, thismb->mac, (size_t)mac_size) != 0)
- enc_err = 0;
- if (thisrr->length > SSL3_RT_MAX_COMPRESSED_LENGTH + mac_size)
- enc_err = 0;
- #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
- if (enc_err == 0 && mac_size > 0 && thismb != NULL &&
- thismb->mac != NULL && (md[0] ^ thismb->mac[0]) != 0xFF) {
- enc_err = 1;
- }
- #endif
- }
- }
- if (enc_err == 0) {
- if (rl->alert != SSL_AD_NO_ALERT) {
- /* We already called RLAYERfatal() */
- goto end;
- }
- /*
- * A separate 'decryption_failed' alert was introduced with TLS 1.0,
- * SSL 3.0 only has 'bad_record_mac'. But unless a decryption
- * failure is directly visible from the ciphertext anyway, we should
- * not reveal which kind of error occurred -- this might become
- * visible to an attacker (e.g. via a logfile)
- */
- RLAYERfatal(rl, SSL_AD_BAD_RECORD_MAC,
- SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
- goto end;
- }
- for (j = 0; j < num_recs; j++) {
- thisrr = &rr[j];
- if (!rl->funcs->post_process_record(rl, thisrr)) {
- /* RLAYERfatal already called */
- goto end;
- }
- /*
- * Record overflow checking (e.g. checking if
- * thisrr->length > SSL3_RT_MAX_PLAIN_LENGTH) is the responsibility of
- * the post_process_record() function above. However we check here if
- * the received packet overflows the current Max Fragment Length setting
- * if there is one.
- * Note: rl->max_frag_len != SSL3_RT_MAX_PLAIN_LENGTH and KTLS are
- * mutually exclusive. Also note that with KTLS thisrr->length can
- * be > SSL3_RT_MAX_PLAIN_LENGTH (and rl->max_frag_len must be ignored)
- */
- if (rl->max_frag_len != SSL3_RT_MAX_PLAIN_LENGTH
- && thisrr->length > rl->max_frag_len) {
- RLAYERfatal(rl, SSL_AD_RECORD_OVERFLOW, SSL_R_DATA_LENGTH_TOO_LONG);
- goto end;
- }
- thisrr->off = 0;
- /*-
- * So at this point the following is true
- * thisrr->type is the type of record
- * thisrr->length == number of bytes in record
- * thisrr->off == offset to first valid byte
- * thisrr->data == where to take bytes from, increment after use :-).
- */
- /* just read a 0 length packet */
- if (thisrr->length == 0) {
- if (++(rl->empty_record_count) > MAX_EMPTY_RECORDS) {
- RLAYERfatal(rl, SSL_AD_UNEXPECTED_MESSAGE,
- SSL_R_RECORD_TOO_SMALL);
- goto end;
- }
- } else {
- rl->empty_record_count = 0;
- }
- }
- if (rl->level == OSSL_RECORD_PROTECTION_LEVEL_EARLY) {
- thisrr = &rr[0];
- if (thisrr->type == SSL3_RT_APPLICATION_DATA
- && !rlayer_early_data_count_ok(rl, thisrr->length, 0, 0)) {
- /* RLAYERfatal already called */
- goto end;
- }
- }
- rl->num_recs = num_recs;
- rl->curr_rec = 0;
- rl->num_released = 0;
- ret = OSSL_RECORD_RETURN_SUCCESS;
- end:
- if (macbufs != NULL) {
- for (j = 0; j < num_recs; j++) {
- if (macbufs[j].alloced)
- OPENSSL_free(macbufs[j].mac);
- }
- OPENSSL_free(macbufs);
- }
- return ret;
- }
- /* Shared by ssl3_meth and tls1_meth */
- int tls_default_validate_record_header(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *rec)
- {
- size_t len = SSL3_RT_MAX_ENCRYPTED_LENGTH;
- if (rec->rec_version != rl->version) {
- RLAYERfatal(rl, SSL_AD_PROTOCOL_VERSION, SSL_R_WRONG_VERSION_NUMBER);
- return 0;
- }
- #ifndef OPENSSL_NO_COMP
- /*
- * If OPENSSL_NO_COMP is defined then SSL3_RT_MAX_ENCRYPTED_LENGTH
- * does not include the compression overhead anyway.
- */
- if (rl->compctx == NULL)
- len -= SSL3_RT_MAX_COMPRESSED_OVERHEAD;
- #endif
- if (rec->length > len) {
- RLAYERfatal(rl, SSL_AD_RECORD_OVERFLOW,
- SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
- return 0;
- }
- return 1;
- }
- int tls_do_compress(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *wr)
- {
- #ifndef OPENSSL_NO_COMP
- int i;
- i = COMP_compress_block(rl->compctx, wr->data,
- (int)(wr->length + SSL3_RT_MAX_COMPRESSED_OVERHEAD),
- wr->input, (int)wr->length);
- if (i < 0)
- return 0;
- wr->length = i;
- wr->input = wr->data;
- return 1;
- #else
- return 0;
- #endif
- }
- int tls_do_uncompress(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *rec)
- {
- #ifndef OPENSSL_NO_COMP
- int i;
- if (rec->comp == NULL) {
- rec->comp = (unsigned char *)
- OPENSSL_malloc(SSL3_RT_MAX_ENCRYPTED_LENGTH);
- }
- if (rec->comp == NULL)
- return 0;
- i = COMP_expand_block(rl->compctx, rec->comp, SSL3_RT_MAX_PLAIN_LENGTH,
- rec->data, (int)rec->length);
- if (i < 0)
- return 0;
- else
- rec->length = i;
- rec->data = rec->comp;
- return 1;
- #else
- return 0;
- #endif
- }
- /* Shared by tlsany_meth, ssl3_meth and tls1_meth */
- int tls_default_post_process_record(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *rec)
- {
- if (rl->compctx != NULL) {
- if (rec->length > SSL3_RT_MAX_COMPRESSED_LENGTH) {
- RLAYERfatal(rl, SSL_AD_RECORD_OVERFLOW,
- SSL_R_COMPRESSED_LENGTH_TOO_LONG);
- return 0;
- }
- if (!tls_do_uncompress(rl, rec)) {
- RLAYERfatal(rl, SSL_AD_DECOMPRESSION_FAILURE,
- SSL_R_BAD_DECOMPRESSION);
- return 0;
- }
- }
- if (rec->length > SSL3_RT_MAX_PLAIN_LENGTH) {
- RLAYERfatal(rl, SSL_AD_RECORD_OVERFLOW, SSL_R_DATA_LENGTH_TOO_LONG);
- return 0;
- }
- return 1;
- }
- /* Shared by tls13_meth and ktls_meth */
- int tls13_common_post_process_record(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *rec)
- {
- if (rec->type != SSL3_RT_APPLICATION_DATA
- && rec->type != SSL3_RT_ALERT
- && rec->type != SSL3_RT_HANDSHAKE) {
- RLAYERfatal(rl, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_BAD_RECORD_TYPE);
- return 0;
- }
- if (rl->msg_callback != NULL)
- rl->msg_callback(0, rl->version, SSL3_RT_INNER_CONTENT_TYPE, &rec->type,
- 1, rl->cbarg);
- /*
- * TLSv1.3 alert and handshake records are required to be non-zero in
- * length.
- */
- if ((rec->type == SSL3_RT_HANDSHAKE || rec->type == SSL3_RT_ALERT)
- && rec->length == 0) {
- RLAYERfatal(rl, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_BAD_LENGTH);
- return 0;
- }
- return 1;
- }
- int tls_read_record(OSSL_RECORD_LAYER *rl, void **rechandle, int *rversion,
- uint8_t *type, const unsigned char **data, size_t *datalen,
- uint16_t *epoch, unsigned char *seq_num)
- {
- TLS_RL_RECORD *rec;
- /*
- * tls_get_more_records() can return success without actually reading
- * anything useful (i.e. if empty records are read). We loop here until
- * we have something useful. tls_get_more_records() will eventually fail if
- * too many sequential empty records are read.
- */
- while (rl->curr_rec >= rl->num_recs) {
- int ret;
- if (rl->num_released != rl->num_recs) {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, SSL_R_RECORDS_NOT_RELEASED);
- return OSSL_RECORD_RETURN_FATAL;
- }
- ret = rl->funcs->get_more_records(rl);
- if (ret != OSSL_RECORD_RETURN_SUCCESS)
- return ret;
- }
- /*
- * We have now got rl->num_recs records buffered in rl->rrec. rl->curr_rec
- * points to the next one to read.
- */
- rec = &rl->rrec[rl->curr_rec++];
- *rechandle = rec;
- *rversion = rec->rec_version;
- *type = rec->type;
- *data = rec->data + rec->off;
- *datalen = rec->length;
- if (rl->isdtls) {
- *epoch = rec->epoch;
- memcpy(seq_num, rec->seq_num, sizeof(rec->seq_num));
- }
- return OSSL_RECORD_RETURN_SUCCESS;
- }
- int tls_release_record(OSSL_RECORD_LAYER *rl, void *rechandle, size_t length)
- {
- TLS_RL_RECORD *rec = &rl->rrec[rl->num_released];
- if (!ossl_assert(rl->num_released < rl->curr_rec)
- || !ossl_assert(rechandle == rec)) {
- /* Should not happen */
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, SSL_R_INVALID_RECORD);
- return OSSL_RECORD_RETURN_FATAL;
- }
- if (rec->length < length) {
- /* Should not happen */
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
- return OSSL_RECORD_RETURN_FATAL;
- }
- if ((rl->options & SSL_OP_CLEANSE_PLAINTEXT) != 0)
- OPENSSL_cleanse(rec->data + rec->off, length);
- rec->off += length;
- rec->length -= length;
- if (rec->length > 0)
- return OSSL_RECORD_RETURN_SUCCESS;
- rl->num_released++;
- if (rl->curr_rec == rl->num_released
- && (rl->mode & SSL_MODE_RELEASE_BUFFERS) != 0
- && TLS_BUFFER_get_left(&rl->rbuf) == 0)
- tls_release_read_buffer(rl);
- return OSSL_RECORD_RETURN_SUCCESS;
- }
- int tls_set_options(OSSL_RECORD_LAYER *rl, const OSSL_PARAM *options)
- {
- const OSSL_PARAM *p;
- p = OSSL_PARAM_locate_const(options, OSSL_LIBSSL_RECORD_LAYER_PARAM_OPTIONS);
- if (p != NULL && !OSSL_PARAM_get_uint64(p, &rl->options)) {
- ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
- return 0;
- }
- p = OSSL_PARAM_locate_const(options, OSSL_LIBSSL_RECORD_LAYER_PARAM_MODE);
- if (p != NULL && !OSSL_PARAM_get_uint32(p, &rl->mode)) {
- ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
- return 0;
- }
- if (rl->direction == OSSL_RECORD_DIRECTION_READ) {
- p = OSSL_PARAM_locate_const(options,
- OSSL_LIBSSL_RECORD_LAYER_READ_BUFFER_LEN);
- if (p != NULL && !OSSL_PARAM_get_size_t(p, &rl->rbuf.default_len)) {
- ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
- return 0;
- }
- } else {
- p = OSSL_PARAM_locate_const(options,
- OSSL_LIBSSL_RECORD_LAYER_PARAM_BLOCK_PADDING);
- if (p != NULL && !OSSL_PARAM_get_size_t(p, &rl->block_padding)) {
- ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
- return 0;
- }
- }
- if (rl->level == OSSL_RECORD_PROTECTION_LEVEL_APPLICATION) {
- /*
- * We ignore any read_ahead setting prior to the application protection
- * level. Otherwise we may read ahead data in a lower protection level
- * that is destined for a higher protection level. To simplify the logic
- * we don't support that at this stage.
- */
- p = OSSL_PARAM_locate_const(options,
- OSSL_LIBSSL_RECORD_LAYER_PARAM_READ_AHEAD);
- if (p != NULL && !OSSL_PARAM_get_int(p, &rl->read_ahead)) {
- ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
- return 0;
- }
- }
- return 1;
- }
- int
- tls_int_new_record_layer(OSSL_LIB_CTX *libctx, const char *propq, int vers,
- int role, int direction, int level,
- const EVP_CIPHER *ciph, size_t taglen,
- const EVP_MD *md, COMP_METHOD *comp, BIO *prev,
- BIO *transport, BIO *next, const OSSL_PARAM *settings,
- const OSSL_PARAM *options,
- const OSSL_DISPATCH *fns, void *cbarg,
- OSSL_RECORD_LAYER **retrl)
- {
- OSSL_RECORD_LAYER *rl = OPENSSL_zalloc(sizeof(*rl));
- const OSSL_PARAM *p;
- *retrl = NULL;
- if (rl == NULL)
- return OSSL_RECORD_RETURN_FATAL;
- /*
- * Default the value for max_frag_len. This may be overridden by the
- * settings
- */
- rl->max_frag_len = SSL3_RT_MAX_PLAIN_LENGTH;
- /* Loop through all the settings since they must all be understood */
- if (settings != NULL) {
- for (p = settings; p->key != NULL; p++) {
- if (strcmp(p->key, OSSL_LIBSSL_RECORD_LAYER_PARAM_USE_ETM) == 0) {
- if (!OSSL_PARAM_get_int(p, &rl->use_etm)) {
- ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
- goto err;
- }
- } else if (strcmp(p->key,
- OSSL_LIBSSL_RECORD_LAYER_PARAM_MAX_FRAG_LEN) == 0) {
- if (!OSSL_PARAM_get_uint(p, &rl->max_frag_len)) {
- ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
- goto err;
- }
- } else if (strcmp(p->key,
- OSSL_LIBSSL_RECORD_LAYER_PARAM_MAX_EARLY_DATA) == 0) {
- if (!OSSL_PARAM_get_uint32(p, &rl->max_early_data)) {
- ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
- goto err;
- }
- } else if (strcmp(p->key,
- OSSL_LIBSSL_RECORD_LAYER_PARAM_STREAM_MAC) == 0) {
- if (!OSSL_PARAM_get_int(p, &rl->stream_mac)) {
- ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
- goto err;
- }
- } else if (strcmp(p->key,
- OSSL_LIBSSL_RECORD_LAYER_PARAM_TLSTREE) == 0) {
- if (!OSSL_PARAM_get_int(p, &rl->tlstree)) {
- ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
- goto err;
- }
- } else {
- ERR_raise(ERR_LIB_SSL, SSL_R_UNKNOWN_MANDATORY_PARAMETER);
- goto err;
- }
- }
- }
- rl->libctx = libctx;
- rl->propq = propq;
- rl->version = vers;
- rl->role = role;
- rl->direction = direction;
- rl->level = level;
- rl->taglen = taglen;
- rl->md = md;
- rl->alert = SSL_AD_NO_ALERT;
- rl->rstate = SSL_ST_READ_HEADER;
- if (level == OSSL_RECORD_PROTECTION_LEVEL_NONE)
- rl->is_first_record = 1;
- if (!tls_set1_bio(rl, transport))
- goto err;
- if (prev != NULL && !BIO_up_ref(prev))
- goto err;
- rl->prev = prev;
- if (next != NULL && !BIO_up_ref(next))
- goto err;
- rl->next = next;
- rl->cbarg = cbarg;
- if (fns != NULL) {
- for (; fns->function_id != 0; fns++) {
- switch (fns->function_id) {
- case OSSL_FUNC_RLAYER_SKIP_EARLY_DATA:
- rl->skip_early_data = OSSL_FUNC_rlayer_skip_early_data(fns);
- break;
- case OSSL_FUNC_RLAYER_MSG_CALLBACK:
- rl->msg_callback = OSSL_FUNC_rlayer_msg_callback(fns);
- break;
- case OSSL_FUNC_RLAYER_SECURITY:
- rl->security = OSSL_FUNC_rlayer_security(fns);
- break;
- case OSSL_FUNC_RLAYER_PADDING:
- rl->padding = OSSL_FUNC_rlayer_padding(fns);
- default:
- /* Just ignore anything we don't understand */
- break;
- }
- }
- }
- if (!tls_set_options(rl, options)) {
- ERR_raise(ERR_LIB_SSL, SSL_R_FAILED_TO_GET_PARAMETER);
- goto err;
- }
- if ((rl->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) == 0
- && rl->version <= TLS1_VERSION
- && !EVP_CIPHER_is_a(ciph, "NULL")
- && !EVP_CIPHER_is_a(ciph, "RC4")) {
- /*
- * Enable vulnerability countermeasure for CBC ciphers with known-IV
- * problem (http://www.openssl.org/~bodo/tls-cbc.txt)
- */
- rl->need_empty_fragments = 1;
- }
- *retrl = rl;
- return OSSL_RECORD_RETURN_SUCCESS;
- err:
- tls_int_free(rl);
- return OSSL_RECORD_RETURN_FATAL;
- }
- static int
- tls_new_record_layer(OSSL_LIB_CTX *libctx, const char *propq, int vers,
- int role, int direction, int level, uint16_t epoch,
- unsigned char *secret, size_t secretlen,
- unsigned char *key, size_t keylen, unsigned char *iv,
- size_t ivlen, unsigned char *mackey, size_t mackeylen,
- const EVP_CIPHER *ciph, size_t taglen,
- int mactype,
- const EVP_MD *md, COMP_METHOD *comp,
- const EVP_MD *kdfdigest, BIO *prev, BIO *transport,
- BIO *next, BIO_ADDR *local, BIO_ADDR *peer,
- const OSSL_PARAM *settings, const OSSL_PARAM *options,
- const OSSL_DISPATCH *fns, void *cbarg, void *rlarg,
- OSSL_RECORD_LAYER **retrl)
- {
- int ret;
- ret = tls_int_new_record_layer(libctx, propq, vers, role, direction, level,
- ciph, taglen, md, comp, prev,
- transport, next, settings,
- options, fns, cbarg, retrl);
- if (ret != OSSL_RECORD_RETURN_SUCCESS)
- return ret;
- switch (vers) {
- case TLS_ANY_VERSION:
- (*retrl)->funcs = &tls_any_funcs;
- break;
- case TLS1_3_VERSION:
- (*retrl)->funcs = &tls_1_3_funcs;
- break;
- case TLS1_2_VERSION:
- case TLS1_1_VERSION:
- case TLS1_VERSION:
- (*retrl)->funcs = &tls_1_funcs;
- break;
- case SSL3_VERSION:
- (*retrl)->funcs = &ssl_3_0_funcs;
- break;
- default:
- /* Should not happen */
- ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
- ret = OSSL_RECORD_RETURN_FATAL;
- goto err;
- }
- ret = (*retrl)->funcs->set_crypto_state(*retrl, level, key, keylen, iv,
- ivlen, mackey, mackeylen, ciph,
- taglen, mactype, md, comp);
- err:
- if (ret != OSSL_RECORD_RETURN_SUCCESS) {
- tls_int_free(*retrl);
- *retrl = NULL;
- }
- return ret;
- }
- static void tls_int_free(OSSL_RECORD_LAYER *rl)
- {
- BIO_free(rl->prev);
- BIO_free(rl->bio);
- BIO_free(rl->next);
- ossl_tls_buffer_release(&rl->rbuf);
- tls_release_write_buffer(rl);
- EVP_CIPHER_CTX_free(rl->enc_ctx);
- EVP_MD_CTX_free(rl->md_ctx);
- #ifndef OPENSSL_NO_COMP
- COMP_CTX_free(rl->compctx);
- #endif
- if (rl->version == SSL3_VERSION)
- OPENSSL_cleanse(rl->mac_secret, sizeof(rl->mac_secret));
- TLS_RL_RECORD_release(rl->rrec, SSL_MAX_PIPELINES);
- OPENSSL_free(rl);
- }
- int tls_free(OSSL_RECORD_LAYER *rl)
- {
- TLS_BUFFER *rbuf;
- size_t left, written;
- int ret = 1;
- if (rl == NULL)
- return 1;
- rbuf = &rl->rbuf;
- left = TLS_BUFFER_get_left(rbuf);
- if (left > 0) {
- /*
- * This record layer is closing but we still have data left in our
- * buffer. It must be destined for the next epoch - so push it there.
- */
- ret = BIO_write_ex(rl->next, rbuf->buf + rbuf->offset, left, &written);
- }
- tls_int_free(rl);
- return ret;
- }
- int tls_unprocessed_read_pending(OSSL_RECORD_LAYER *rl)
- {
- return TLS_BUFFER_get_left(&rl->rbuf) != 0;
- }
- int tls_processed_read_pending(OSSL_RECORD_LAYER *rl)
- {
- return rl->curr_rec < rl->num_recs;
- }
- size_t tls_app_data_pending(OSSL_RECORD_LAYER *rl)
- {
- size_t i;
- size_t num = 0;
- for (i = rl->curr_rec; i < rl->num_recs; i++) {
- if (rl->rrec[i].type != SSL3_RT_APPLICATION_DATA)
- return num;
- num += rl->rrec[i].length;
- }
- return num;
- }
- size_t tls_get_max_records_default(OSSL_RECORD_LAYER *rl, uint8_t type,
- size_t len,
- size_t maxfrag, size_t *preffrag)
- {
- /*
- * If we have a pipeline capable cipher, and we have been configured to use
- * it, then return the preferred number of pipelines.
- */
- if (rl->max_pipelines > 0
- && rl->enc_ctx != NULL
- && (EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(rl->enc_ctx))
- & EVP_CIPH_FLAG_PIPELINE) != 0
- && RLAYER_USE_EXPLICIT_IV(rl)) {
- size_t pipes;
- if (len == 0)
- return 1;
- pipes = ((len - 1) / *preffrag) + 1;
- return (pipes < rl->max_pipelines) ? pipes : rl->max_pipelines;
- }
- return 1;
- }
- size_t tls_get_max_records(OSSL_RECORD_LAYER *rl, uint8_t type, size_t len,
- size_t maxfrag, size_t *preffrag)
- {
- return rl->funcs->get_max_records(rl, type, len, maxfrag, preffrag);
- }
- int tls_allocate_write_buffers_default(OSSL_RECORD_LAYER *rl,
- OSSL_RECORD_TEMPLATE *templates,
- size_t numtempl,
- size_t *prefix)
- {
- if (!tls_setup_write_buffer(rl, numtempl, 0, 0)) {
- /* RLAYERfatal() already called */
- return 0;
- }
- return 1;
- }
- int tls_initialise_write_packets_default(OSSL_RECORD_LAYER *rl,
- OSSL_RECORD_TEMPLATE *templates,
- size_t numtempl,
- OSSL_RECORD_TEMPLATE *prefixtempl,
- WPACKET *pkt,
- TLS_BUFFER *bufs,
- size_t *wpinited)
- {
- WPACKET *thispkt;
- size_t j, align;
- TLS_BUFFER *wb;
- for (j = 0; j < numtempl; j++) {
- thispkt = &pkt[j];
- wb = &bufs[j];
- wb->type = templates[j].type;
- #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD != 0
- align = (size_t)TLS_BUFFER_get_buf(wb);
- align += rl->isdtls ? DTLS1_RT_HEADER_LENGTH : SSL3_RT_HEADER_LENGTH;
- align = SSL3_ALIGN_PAYLOAD - 1
- - ((align - 1) % SSL3_ALIGN_PAYLOAD);
- #endif
- TLS_BUFFER_set_offset(wb, align);
- if (!WPACKET_init_static_len(thispkt, TLS_BUFFER_get_buf(wb),
- TLS_BUFFER_get_len(wb), 0)) {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
- return 0;
- }
- (*wpinited)++;
- if (!WPACKET_allocate_bytes(thispkt, align, NULL)) {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
- return 0;
- }
- }
- return 1;
- }
- int tls_prepare_record_header_default(OSSL_RECORD_LAYER *rl,
- WPACKET *thispkt,
- OSSL_RECORD_TEMPLATE *templ,
- uint8_t rectype,
- unsigned char **recdata)
- {
- size_t maxcomplen;
- *recdata = NULL;
- maxcomplen = templ->buflen;
- if (rl->compctx != NULL)
- maxcomplen += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
- if (!WPACKET_put_bytes_u8(thispkt, rectype)
- || !WPACKET_put_bytes_u16(thispkt, templ->version)
- || !WPACKET_start_sub_packet_u16(thispkt)
- || (rl->eivlen > 0
- && !WPACKET_allocate_bytes(thispkt, rl->eivlen, NULL))
- || (maxcomplen > 0
- && !WPACKET_reserve_bytes(thispkt, maxcomplen,
- recdata))) {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
- return 0;
- }
- return 1;
- }
- int tls_prepare_for_encryption_default(OSSL_RECORD_LAYER *rl,
- size_t mac_size,
- WPACKET *thispkt,
- TLS_RL_RECORD *thiswr)
- {
- size_t len;
- unsigned char *recordstart;
- /*
- * we should still have the output to thiswr->data and the input from
- * wr->input. Length should be thiswr->length. thiswr->data still points
- * in the wb->buf
- */
- if (!rl->use_etm && mac_size != 0) {
- unsigned char *mac;
- if (!WPACKET_allocate_bytes(thispkt, mac_size, &mac)
- || !rl->funcs->mac(rl, thiswr, mac, 1)) {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
- return 0;
- }
- }
- /*
- * Reserve some bytes for any growth that may occur during encryption. If
- * we are adding the MAC independently of the cipher algorithm, then the
- * max encrypted overhead does not need to include an allocation for that
- * MAC
- */
- if (!WPACKET_reserve_bytes(thispkt, SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD
- - mac_size, NULL)
- /*
- * We also need next the amount of bytes written to this
- * sub-packet
- */
- || !WPACKET_get_length(thispkt, &len)) {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
- return 0;
- }
- /* Get a pointer to the start of this record excluding header */
- recordstart = WPACKET_get_curr(thispkt) - len;
- TLS_RL_RECORD_set_data(thiswr, recordstart);
- TLS_RL_RECORD_reset_input(thiswr);
- TLS_RL_RECORD_set_length(thiswr, len);
- return 1;
- }
- int tls_post_encryption_processing_default(OSSL_RECORD_LAYER *rl,
- size_t mac_size,
- OSSL_RECORD_TEMPLATE *thistempl,
- WPACKET *thispkt,
- TLS_RL_RECORD *thiswr)
- {
- size_t origlen, len;
- size_t headerlen = rl->isdtls ? DTLS1_RT_HEADER_LENGTH
- : SSL3_RT_HEADER_LENGTH;
- /* Allocate bytes for the encryption overhead */
- if (!WPACKET_get_length(thispkt, &origlen)
- /* Check we allowed enough room for the encryption growth */
- || !ossl_assert(origlen + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD
- - mac_size >= thiswr->length)
- /* Encryption should never shrink the data! */
- || origlen > thiswr->length
- || (thiswr->length > origlen
- && !WPACKET_allocate_bytes(thispkt,
- thiswr->length - origlen,
- NULL))) {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
- return 0;
- }
- if (rl->use_etm && mac_size != 0) {
- unsigned char *mac;
- if (!WPACKET_allocate_bytes(thispkt, mac_size, &mac)
- || !rl->funcs->mac(rl, thiswr, mac, 1)) {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
- return 0;
- }
- TLS_RL_RECORD_add_length(thiswr, mac_size);
- }
- if (!WPACKET_get_length(thispkt, &len)
- || !WPACKET_close(thispkt)) {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
- return 0;
- }
- if (rl->msg_callback != NULL) {
- unsigned char *recordstart;
- recordstart = WPACKET_get_curr(thispkt) - len - headerlen;
- rl->msg_callback(1, thiswr->rec_version, SSL3_RT_HEADER, recordstart,
- headerlen, rl->cbarg);
- if (rl->version == TLS1_3_VERSION && rl->enc_ctx != NULL) {
- unsigned char ctype = thistempl->type;
- rl->msg_callback(1, thiswr->rec_version, SSL3_RT_INNER_CONTENT_TYPE,
- &ctype, 1, rl->cbarg);
- }
- }
- if (!WPACKET_finish(thispkt)) {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
- return 0;
- }
- TLS_RL_RECORD_add_length(thiswr, headerlen);
- return 1;
- }
- int tls_write_records_default(OSSL_RECORD_LAYER *rl,
- OSSL_RECORD_TEMPLATE *templates,
- size_t numtempl)
- {
- WPACKET pkt[SSL_MAX_PIPELINES + 1];
- TLS_RL_RECORD wr[SSL_MAX_PIPELINES + 1];
- WPACKET *thispkt;
- TLS_RL_RECORD *thiswr;
- int mac_size = 0, ret = 0;
- size_t wpinited = 0;
- size_t j, prefix = 0;
- OSSL_RECORD_TEMPLATE prefixtempl;
- OSSL_RECORD_TEMPLATE *thistempl;
- if (rl->md_ctx != NULL && EVP_MD_CTX_get0_md(rl->md_ctx) != NULL) {
- mac_size = EVP_MD_CTX_get_size(rl->md_ctx);
- if (mac_size < 0) {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
- goto err;
- }
- }
- if (!rl->funcs->allocate_write_buffers(rl, templates, numtempl, &prefix)) {
- /* RLAYERfatal() already called */
- goto err;
- }
- if (!rl->funcs->initialise_write_packets(rl, templates, numtempl,
- &prefixtempl, pkt, rl->wbuf,
- &wpinited)) {
- /* RLAYERfatal() already called */
- goto err;
- }
- /* Clear our TLS_RL_RECORD structures */
- memset(wr, 0, sizeof(wr));
- for (j = 0; j < numtempl + prefix; j++) {
- unsigned char *compressdata = NULL;
- uint8_t rectype;
- thispkt = &pkt[j];
- thiswr = &wr[j];
- thistempl = (j < prefix) ? &prefixtempl : &templates[j - prefix];
- /*
- * Default to the record type as specified in the template unless the
- * protocol implementation says differently.
- */
- if (rl->funcs->get_record_type != NULL)
- rectype = rl->funcs->get_record_type(rl, thistempl);
- else
- rectype = thistempl->type;
- TLS_RL_RECORD_set_type(thiswr, rectype);
- TLS_RL_RECORD_set_rec_version(thiswr, thistempl->version);
- if (!rl->funcs->prepare_record_header(rl, thispkt, thistempl, rectype,
- &compressdata)) {
- /* RLAYERfatal() already called */
- goto err;
- }
- /* lets setup the record stuff. */
- TLS_RL_RECORD_set_data(thiswr, compressdata);
- TLS_RL_RECORD_set_length(thiswr, thistempl->buflen);
- TLS_RL_RECORD_set_input(thiswr, (unsigned char *)thistempl->buf);
- /*
- * we now 'read' from thiswr->input, thiswr->length bytes into
- * thiswr->data
- */
- /* first we compress */
- if (rl->compctx != NULL) {
- if (!tls_do_compress(rl, thiswr)
- || !WPACKET_allocate_bytes(thispkt, thiswr->length, NULL)) {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, SSL_R_COMPRESSION_FAILURE);
- goto err;
- }
- } else if (compressdata != NULL) {
- if (!WPACKET_memcpy(thispkt, thiswr->input, thiswr->length)) {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
- goto err;
- }
- TLS_RL_RECORD_reset_input(&wr[j]);
- }
- if (rl->funcs->add_record_padding != NULL
- && !rl->funcs->add_record_padding(rl, thistempl, thispkt,
- thiswr)) {
- /* RLAYERfatal() already called */
- goto err;
- }
- if (!rl->funcs->prepare_for_encryption(rl, mac_size, thispkt, thiswr)) {
- /* RLAYERfatal() already called */
- goto err;
- }
- }
- if (prefix) {
- if (rl->funcs->cipher(rl, wr, 1, 1, NULL, mac_size) < 1) {
- if (rl->alert == SSL_AD_NO_ALERT) {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
- }
- goto err;
- }
- }
- if (rl->funcs->cipher(rl, wr + prefix, numtempl, 1, NULL, mac_size) < 1) {
- if (rl->alert == SSL_AD_NO_ALERT) {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
- }
- goto err;
- }
- for (j = 0; j < numtempl + prefix; j++) {
- thispkt = &pkt[j];
- thiswr = &wr[j];
- thistempl = (j < prefix) ? &prefixtempl : &templates[j - prefix];
- if (!rl->funcs->post_encryption_processing(rl, mac_size, thistempl,
- thispkt, thiswr)) {
- /* RLAYERfatal() already called */
- goto err;
- }
- /* now let's set up wb */
- TLS_BUFFER_set_left(&rl->wbuf[j], TLS_RL_RECORD_get_length(thiswr));
- }
- ret = 1;
- err:
- for (j = 0; j < wpinited; j++)
- WPACKET_cleanup(&pkt[j]);
- return ret;
- }
- int tls_write_records(OSSL_RECORD_LAYER *rl, OSSL_RECORD_TEMPLATE *templates,
- size_t numtempl)
- {
- /* Check we don't have pending data waiting to write */
- if (!ossl_assert(rl->nextwbuf >= rl->numwpipes
- || TLS_BUFFER_get_left(&rl->wbuf[rl->nextwbuf]) == 0)) {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
- return OSSL_RECORD_RETURN_FATAL;
- }
- if (!rl->funcs->write_records(rl, templates, numtempl)) {
- /* RLAYERfatal already called */
- return OSSL_RECORD_RETURN_FATAL;
- }
- rl->nextwbuf = 0;
- /* we now just need to write the buffers */
- return tls_retry_write_records(rl);
- }
- int tls_retry_write_records(OSSL_RECORD_LAYER *rl)
- {
- int i, ret;
- TLS_BUFFER *thiswb;
- size_t tmpwrit = 0;
- if (rl->nextwbuf >= rl->numwpipes)
- return OSSL_RECORD_RETURN_SUCCESS;
- for (;;) {
- thiswb = &rl->wbuf[rl->nextwbuf];
- clear_sys_error();
- if (rl->bio != NULL) {
- if (rl->funcs->prepare_write_bio != NULL) {
- ret = rl->funcs->prepare_write_bio(rl, thiswb->type);
- if (ret != OSSL_RECORD_RETURN_SUCCESS)
- return ret;
- }
- i = BIO_write(rl->bio, (char *)
- &(TLS_BUFFER_get_buf(thiswb)
- [TLS_BUFFER_get_offset(thiswb)]),
- (unsigned int)TLS_BUFFER_get_left(thiswb));
- if (i >= 0) {
- tmpwrit = i;
- if (i == 0 && BIO_should_retry(rl->bio))
- ret = OSSL_RECORD_RETURN_RETRY;
- else
- ret = OSSL_RECORD_RETURN_SUCCESS;
- } else {
- if (BIO_should_retry(rl->bio)) {
- ret = OSSL_RECORD_RETURN_RETRY;
- } else {
- ERR_raise_data(ERR_LIB_SYS, get_last_sys_error(),
- "tls_retry_write_records failure");
- ret = OSSL_RECORD_RETURN_FATAL;
- }
- }
- } else {
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, SSL_R_BIO_NOT_SET);
- ret = OSSL_RECORD_RETURN_FATAL;
- i = -1;
- }
- /*
- * When an empty fragment is sent on a connection using KTLS,
- * it is sent as a write of zero bytes. If this zero byte
- * write succeeds, i will be 0 rather than a non-zero value.
- * Treat i == 0 as success rather than an error for zero byte
- * writes to permit this case.
- */
- if (i >= 0 && tmpwrit == TLS_BUFFER_get_left(thiswb)) {
- TLS_BUFFER_set_left(thiswb, 0);
- TLS_BUFFER_add_offset(thiswb, tmpwrit);
- if (++(rl->nextwbuf) < rl->numwpipes)
- continue;
- if (rl->nextwbuf == rl->numwpipes
- && (rl->mode & SSL_MODE_RELEASE_BUFFERS) != 0)
- tls_release_write_buffer(rl);
- return OSSL_RECORD_RETURN_SUCCESS;
- } else if (i <= 0) {
- if (rl->isdtls) {
- /*
- * For DTLS, just drop it. That's kind of the whole point in
- * using a datagram service
- */
- TLS_BUFFER_set_left(thiswb, 0);
- if (++(rl->nextwbuf) == rl->numwpipes
- && (rl->mode & SSL_MODE_RELEASE_BUFFERS) != 0)
- tls_release_write_buffer(rl);
- }
- return ret;
- }
- TLS_BUFFER_add_offset(thiswb, tmpwrit);
- TLS_BUFFER_sub_left(thiswb, tmpwrit);
- }
- }
- int tls_get_alert_code(OSSL_RECORD_LAYER *rl)
- {
- return rl->alert;
- }
- int tls_set1_bio(OSSL_RECORD_LAYER *rl, BIO *bio)
- {
- if (bio != NULL && !BIO_up_ref(bio))
- return 0;
- BIO_free(rl->bio);
- rl->bio = bio;
- return 1;
- }
- /* Shared by most methods except tlsany_meth */
- int tls_default_set_protocol_version(OSSL_RECORD_LAYER *rl, int version)
- {
- if (rl->version != version)
- return 0;
- return 1;
- }
- int tls_set_protocol_version(OSSL_RECORD_LAYER *rl, int version)
- {
- return rl->funcs->set_protocol_version(rl, version);
- }
- void tls_set_plain_alerts(OSSL_RECORD_LAYER *rl, int allow)
- {
- rl->allow_plain_alerts = allow;
- }
- void tls_set_first_handshake(OSSL_RECORD_LAYER *rl, int first)
- {
- rl->is_first_handshake = first;
- }
- void tls_set_max_pipelines(OSSL_RECORD_LAYER *rl, size_t max_pipelines)
- {
- rl->max_pipelines = max_pipelines;
- if (max_pipelines > 1)
- rl->read_ahead = 1;
- }
- void tls_get_state(OSSL_RECORD_LAYER *rl, const char **shortstr,
- const char **longstr)
- {
- const char *shrt, *lng;
- switch (rl->rstate) {
- case SSL_ST_READ_HEADER:
- shrt = "RH";
- lng = "read header";
- break;
- case SSL_ST_READ_BODY:
- shrt = "RB";
- lng = "read body";
- break;
- default:
- shrt = lng = "unknown";
- break;
- }
- if (shortstr != NULL)
- *shortstr = shrt;
- if (longstr != NULL)
- *longstr = lng;
- }
- const COMP_METHOD *tls_get_compression(OSSL_RECORD_LAYER *rl)
- {
- #ifndef OPENSSL_NO_COMP
- return (rl->compctx == NULL) ? NULL : COMP_CTX_get_method(rl->compctx);
- #else
- return NULL;
- #endif
- }
- void tls_set_max_frag_len(OSSL_RECORD_LAYER *rl, size_t max_frag_len)
- {
- rl->max_frag_len = max_frag_len;
- /*
- * We don't need to adjust buffer sizes. Write buffer sizes are
- * automatically checked anyway. We should only be changing the read buffer
- * size during the handshake, so we will create a new buffer when we create
- * the new record layer. We can't change the existing buffer because it may
- * already have data in it.
- */
- }
- int tls_increment_sequence_ctr(OSSL_RECORD_LAYER *rl)
- {
- int i;
- /* Increment the sequence counter */
- for (i = SEQ_NUM_SIZE; i > 0; i--) {
- ++(rl->sequence[i - 1]);
- if (rl->sequence[i - 1] != 0)
- break;
- }
- if (i == 0) {
- /* Sequence has wrapped */
- RLAYERfatal(rl, SSL_AD_INTERNAL_ERROR, SSL_R_SEQUENCE_CTR_WRAPPED);
- return 0;
- }
- return 1;
- }
- int tls_alloc_buffers(OSSL_RECORD_LAYER *rl)
- {
- if (rl->direction == OSSL_RECORD_DIRECTION_WRITE) {
- /* If we have a pending write then buffers are already allocated */
- if (rl->nextwbuf < rl->numwpipes)
- return 1;
- /*
- * We assume 1 pipe with default sized buffer. If what we need ends up
- * being a different size to that then it will be reallocated on demand.
- * If we need more than 1 pipe then that will also be allocated on
- * demand
- */
- if (!tls_setup_write_buffer(rl, 1, 0, 0))
- return 0;
- /*
- * Normally when we allocate write buffers we immediately write
- * something into it. In this case we're not doing that so mark the
- * buffer as empty.
- */
- TLS_BUFFER_set_left(&rl->wbuf[0], 0);
- return 1;
- }
- /* Read direction */
- /* If we have pending data to be read then buffers are already allocated */
- if (rl->curr_rec < rl->num_recs || TLS_BUFFER_get_left(&rl->rbuf) != 0)
- return 1;
- return tls_setup_read_buffer(rl);
- }
- int tls_free_buffers(OSSL_RECORD_LAYER *rl)
- {
- if (rl->direction == OSSL_RECORD_DIRECTION_WRITE) {
- if (rl->nextwbuf < rl->numwpipes) {
- /*
- * We may have pending data. If we've just got one empty buffer
- * allocated then it has probably just been alloc'd via
- * tls_alloc_buffers, and it is fine to free it. Otherwise this
- * looks like real pending data and it is an error.
- */
- if (rl->nextwbuf != 0
- || rl->numwpipes != 1
- || TLS_BUFFER_get_left(&rl->wbuf[0]) != 0)
- return 0;
- }
- tls_release_write_buffer(rl);
- return 1;
- }
- /* Read direction */
- /* If we have pending data to be read then fail */
- if (rl->curr_rec < rl->num_recs || TLS_BUFFER_get_left(&rl->rbuf) != 0)
- return 0;
- return tls_release_read_buffer(rl);
- }
- const OSSL_RECORD_METHOD ossl_tls_record_method = {
- tls_new_record_layer,
- tls_free,
- tls_unprocessed_read_pending,
- tls_processed_read_pending,
- tls_app_data_pending,
- tls_get_max_records,
- tls_write_records,
- tls_retry_write_records,
- tls_read_record,
- tls_release_record,
- tls_get_alert_code,
- tls_set1_bio,
- tls_set_protocol_version,
- tls_set_plain_alerts,
- tls_set_first_handshake,
- tls_set_max_pipelines,
- NULL,
- tls_get_state,
- tls_set_options,
- tls_get_compression,
- tls_set_max_frag_len,
- NULL,
- tls_increment_sequence_ctr,
- tls_alloc_buffers,
- tls_free_buffers
- };
|