d1_pkt.c revision c895d6b1c580258e72e1ed3fcc86d38970ded9e1
14602a6fe08692b38cf36aa3cdb5c4e340e6929d7crazyboblee/* DTLS implementation written by Nagendra Modadugu 2f04bba8fa0d0c926f80225b03fe9280748cc2210limpbizkit * (nagendra@cs.stanford.edu) for the OpenSSL project 2005. */ 34602a6fe08692b38cf36aa3cdb5c4e340e6929d7crazyboblee/* ==================================================================== 44602a6fe08692b38cf36aa3cdb5c4e340e6929d7crazyboblee * Copyright (c) 1998-2005 The OpenSSL Project. All rights reserved. 54602a6fe08692b38cf36aa3cdb5c4e340e6929d7crazyboblee * 64602a6fe08692b38cf36aa3cdb5c4e340e6929d7crazyboblee * Redistribution and use in source and binary forms, with or without 74602a6fe08692b38cf36aa3cdb5c4e340e6929d7crazyboblee * modification, are permitted provided that the following conditions 84602a6fe08692b38cf36aa3cdb5c4e340e6929d7crazyboblee * are met: 94602a6fe08692b38cf36aa3cdb5c4e340e6929d7crazyboblee * 104602a6fe08692b38cf36aa3cdb5c4e340e6929d7crazyboblee * 1. Redistributions of source code must retain the above copyright 114602a6fe08692b38cf36aa3cdb5c4e340e6929d7crazyboblee * notice, this list of conditions and the following disclaimer. 124602a6fe08692b38cf36aa3cdb5c4e340e6929d7crazyboblee * 134602a6fe08692b38cf36aa3cdb5c4e340e6929d7crazyboblee * 2. Redistributions in binary form must reproduce the above copyright 144602a6fe08692b38cf36aa3cdb5c4e340e6929d7crazyboblee * notice, this list of conditions and the following disclaimer in 154602a6fe08692b38cf36aa3cdb5c4e340e6929d7crazyboblee * the documentation and/or other materials provided with the 164602a6fe08692b38cf36aa3cdb5c4e340e6929d7crazyboblee * distribution. 174602a6fe08692b38cf36aa3cdb5c4e340e6929d7crazyboblee * 18484f75f87f526b692f74afdef0e34d2bc6937f0climpbizkit * 3. All advertising materials mentioning features or use of this 19646e1742c047dc9a768f2bc065b33e9b5ab49006cgdecker * software must display the following acknowledgment: 20484f75f87f526b692f74afdef0e34d2bc6937f0climpbizkit * "This product includes software developed by the OpenSSL Project 21484f75f87f526b692f74afdef0e34d2bc6937f0climpbizkit * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 22484f75f87f526b692f74afdef0e34d2bc6937f0climpbizkit * 23484f75f87f526b692f74afdef0e34d2bc6937f0climpbizkit * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 244602a6fe08692b38cf36aa3cdb5c4e340e6929d7crazyboblee * endorse or promote products derived from this software without 25646e1742c047dc9a768f2bc065b33e9b5ab49006cgdecker * prior written permission. For written permission, please contact 26 * openssl-core@openssl.org. 27 * 28 * 5. Products derived from this software may not be called "OpenSSL" 29 * nor may "OpenSSL" appear in their names without prior written 30 * permission of the OpenSSL Project. 31 * 32 * 6. Redistributions of any form whatsoever must retain the following 33 * acknowledgment: 34 * "This product includes software developed by the OpenSSL Project 35 * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 36 * 37 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 38 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 39 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 40 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 41 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 42 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 43 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 44 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 45 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 46 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 47 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 48 * OF THE POSSIBILITY OF SUCH DAMAGE. 49 * ==================================================================== 50 * 51 * This product includes cryptographic software written by Eric Young 52 * (eay@cryptsoft.com). This product includes software written by Tim 53 * Hudson (tjh@cryptsoft.com). 54 * 55 */ 56/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 57 * All rights reserved. 58 * 59 * This package is an SSL implementation written 60 * by Eric Young (eay@cryptsoft.com). 61 * The implementation was written so as to conform with Netscapes SSL. 62 * 63 * This library is free for commercial and non-commercial use as long as 64 * the following conditions are aheared to. The following conditions 65 * apply to all code found in this distribution, be it the RC4, RSA, 66 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 67 * included with this distribution is covered by the same copyright terms 68 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 69 * 70 * Copyright remains Eric Young's, and as such any Copyright notices in 71 * the code are not to be removed. 72 * If this package is used in a product, Eric Young should be given attribution 73 * as the author of the parts of the library used. 74 * This can be in the form of a textual message at program startup or 75 * in documentation (online or textual) provided with the package. 76 * 77 * Redistribution and use in source and binary forms, with or without 78 * modification, are permitted provided that the following conditions 79 * are met: 80 * 1. Redistributions of source code must retain the copyright 81 * notice, this list of conditions and the following disclaimer. 82 * 2. Redistributions in binary form must reproduce the above copyright 83 * notice, this list of conditions and the following disclaimer in the 84 * documentation and/or other materials provided with the distribution. 85 * 3. All advertising materials mentioning features or use of this software 86 * must display the following acknowledgement: 87 * "This product includes cryptographic software written by 88 * Eric Young (eay@cryptsoft.com)" 89 * The word 'cryptographic' can be left out if the rouines from the library 90 * being used are not cryptographic related :-). 91 * 4. If you include any Windows specific code (or a derivative thereof) from 92 * the apps directory (application code) you must include an acknowledgement: 93 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 94 * 95 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 96 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 97 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 98 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 99 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 100 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 101 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 102 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 103 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 104 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 105 * SUCH DAMAGE. 106 * 107 * The licence and distribution terms for any publically available version or 108 * derivative of this code cannot be changed. i.e. this code cannot simply be 109 * copied and put under another distribution licence 110 * [including the GNU Public Licence.] */ 111 112#include <openssl/ssl.h> 113 114#include <assert.h> 115#include <string.h> 116 117#include <openssl/bio.h> 118#include <openssl/buf.h> 119#include <openssl/bytestring.h> 120#include <openssl/mem.h> 121#include <openssl/evp.h> 122#include <openssl/err.h> 123#include <openssl/rand.h> 124 125#include "internal.h" 126 127 128int dtls1_get_record(SSL *ssl) { 129again: 130 switch (ssl->s3->recv_shutdown) { 131 case ssl_shutdown_none: 132 break; 133 case ssl_shutdown_fatal_alert: 134 OPENSSL_PUT_ERROR(SSL, SSL_R_PROTOCOL_IS_SHUTDOWN); 135 return -1; 136 case ssl_shutdown_close_notify: 137 return 0; 138 } 139 140 /* Read a new packet if there is no unconsumed one. */ 141 if (ssl_read_buffer_len(ssl) == 0) { 142 int read_ret = ssl_read_buffer_extend_to(ssl, 0 /* unused */); 143 if (read_ret < 0 && dtls1_is_timer_expired(ssl)) { 144 /* For blocking BIOs, retransmits must be handled internally. */ 145 int timeout_ret = DTLSv1_handle_timeout(ssl); 146 if (timeout_ret <= 0) { 147 return timeout_ret; 148 } 149 goto again; 150 } 151 if (read_ret <= 0) { 152 return read_ret; 153 } 154 } 155 assert(ssl_read_buffer_len(ssl) > 0); 156 157 CBS body; 158 uint8_t type, alert; 159 size_t consumed; 160 enum ssl_open_record_t open_ret = 161 dtls_open_record(ssl, &type, &body, &consumed, &alert, 162 ssl_read_buffer(ssl), ssl_read_buffer_len(ssl)); 163 ssl_read_buffer_consume(ssl, consumed); 164 switch (open_ret) { 165 case ssl_open_record_partial: 166 /* Impossible in DTLS. */ 167 break; 168 169 case ssl_open_record_success: 170 if (CBS_len(&body) > 0xffff) { 171 OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW); 172 return -1; 173 } 174 175 SSL3_RECORD *rr = &ssl->s3->rrec; 176 rr->type = type; 177 rr->length = (uint16_t)CBS_len(&body); 178 rr->data = (uint8_t *)CBS_data(&body); 179 return 1; 180 181 case ssl_open_record_discard: 182 goto again; 183 184 case ssl_open_record_close_notify: 185 return 0; 186 187 case ssl_open_record_fatal_alert: 188 return -1; 189 190 case ssl_open_record_error: 191 ssl3_send_alert(ssl, SSL3_AL_FATAL, alert); 192 return -1; 193 } 194 195 assert(0); 196 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); 197 return -1; 198} 199 200int dtls1_read_app_data(SSL *ssl, int *out_got_handshake, uint8_t *buf, int len, 201 int peek) { 202 assert(!SSL_in_init(ssl)); 203 204 *out_got_handshake = 0; 205 SSL3_RECORD *rr = &ssl->s3->rrec; 206 207again: 208 if (rr->length == 0) { 209 int ret = dtls1_get_record(ssl); 210 if (ret <= 0) { 211 return ret; 212 } 213 } 214 215 if (rr->type == SSL3_RT_HANDSHAKE) { 216 /* Parse the first fragment header to determine if this is a pre-CCS or 217 * post-CCS handshake record. DTLS resets handshake message numbers on each 218 * handshake, so renegotiations and retransmissions are ambiguous. */ 219 CBS cbs, body; 220 struct hm_header_st msg_hdr; 221 CBS_init(&cbs, rr->data, rr->length); 222 if (!dtls1_parse_fragment(&cbs, &msg_hdr, &body)) { 223 ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); 224 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_HANDSHAKE_RECORD); 225 return -1; 226 } 227 228 if (msg_hdr.type == SSL3_MT_FINISHED && 229 msg_hdr.seq == ssl->d1->handshake_read_seq - 1) { 230 if (msg_hdr.frag_off == 0) { 231 /* Retransmit our last flight of messages. If the peer sends the second 232 * Finished, they may not have received ours. Only do this for the 233 * first fragment, in case the Finished was fragmented. */ 234 if (dtls1_check_timeout_num(ssl) < 0) { 235 return -1; 236 } 237 238 dtls1_retransmit_outgoing_messages(ssl); 239 } 240 241 rr->length = 0; 242 goto again; 243 } 244 245 /* Otherwise, this is a pre-CCS handshake message from an unsupported 246 * renegotiation attempt. Fall through to the error path. */ 247 } 248 249 if (rr->type != SSL3_RT_APPLICATION_DATA) { 250 ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); 251 OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_RECORD); 252 return -1; 253 } 254 255 /* Discard empty records. */ 256 if (rr->length == 0) { 257 goto again; 258 } 259 260 if (len <= 0) { 261 return len; 262 } 263 264 if ((unsigned)len > rr->length) { 265 len = rr->length; 266 } 267 268 memcpy(buf, rr->data, len); 269 if (!peek) { 270 /* TODO(davidben): Should the record be truncated instead? This is a 271 * datagram transport. See https://crbug.com/boringssl/65. */ 272 rr->length -= len; 273 rr->data += len; 274 if (rr->length == 0) { 275 /* The record has been consumed, so we may now clear the buffer. */ 276 ssl_read_buffer_discard(ssl); 277 } 278 } 279 280 return len; 281} 282 283int dtls1_read_change_cipher_spec(SSL *ssl) { 284 SSL3_RECORD *rr = &ssl->s3->rrec; 285 286again: 287 if (rr->length == 0) { 288 int ret = dtls1_get_record(ssl); 289 if (ret <= 0) { 290 return ret; 291 } 292 } 293 294 /* Drop handshake records silently. The epochs match, so this must be a 295 * retransmit of a message we already received. */ 296 if (rr->type == SSL3_RT_HANDSHAKE) { 297 rr->length = 0; 298 goto again; 299 } 300 301 /* Other record types are illegal in this epoch. Note all application data 302 * records come in the encrypted epoch. */ 303 if (rr->type != SSL3_RT_CHANGE_CIPHER_SPEC) { 304 ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); 305 OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_RECORD); 306 return -1; 307 } 308 309 if (rr->length != 1 || rr->data[0] != SSL3_MT_CCS) { 310 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_CHANGE_CIPHER_SPEC); 311 ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); 312 return -1; 313 } 314 315 ssl_do_msg_callback(ssl, 0 /* read */, ssl->version, 316 SSL3_RT_CHANGE_CIPHER_SPEC, rr->data, rr->length); 317 318 rr->length = 0; 319 ssl_read_buffer_discard(ssl); 320 return 1; 321} 322 323void dtls1_read_close_notify(SSL *ssl) { 324 /* Bidirectional shutdown doesn't make sense for an unordered transport. DTLS 325 * alerts also aren't delivered reliably, so we may even time out because the 326 * peer never received our close_notify. Report to the caller that the channel 327 * has fully shut down. */ 328 if (ssl->s3->recv_shutdown == ssl_shutdown_none) { 329 ssl->s3->recv_shutdown = ssl_shutdown_close_notify; 330 } 331} 332 333int dtls1_write_app_data(SSL *ssl, const void *buf_, int len) { 334 assert(!SSL_in_init(ssl)); 335 336 if (len > SSL3_RT_MAX_PLAIN_LENGTH) { 337 OPENSSL_PUT_ERROR(SSL, SSL_R_DTLS_MESSAGE_TOO_BIG); 338 return -1; 339 } 340 341 if (len < 0) { 342 OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_LENGTH); 343 return -1; 344 } 345 346 if (len == 0) { 347 return 0; 348 } 349 350 int ret = dtls1_write_record(ssl, SSL3_RT_APPLICATION_DATA, buf_, (size_t)len, 351 dtls1_use_current_epoch); 352 if (ret <= 0) { 353 return ret; 354 } 355 return len; 356} 357 358int dtls1_write_record(SSL *ssl, int type, const uint8_t *buf, size_t len, 359 enum dtls1_use_epoch_t use_epoch) { 360 assert(len <= SSL3_RT_MAX_PLAIN_LENGTH); 361 /* There should never be a pending write buffer in DTLS. One can't write half 362 * a datagram, so the write buffer is always dropped in 363 * |ssl_write_buffer_flush|. */ 364 assert(!ssl_write_buffer_is_pending(ssl)); 365 366 /* If we have an alert to send, lets send it */ 367 if (ssl->s3->alert_dispatch) { 368 int ret = ssl->method->dispatch_alert(ssl); 369 if (ret <= 0) { 370 return ret; 371 } 372 /* if it went, fall through and send more stuff */ 373 } 374 375 if (len > SSL3_RT_MAX_PLAIN_LENGTH) { 376 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); 377 return -1; 378 } 379 380 size_t max_out = len + ssl_max_seal_overhead(ssl); 381 uint8_t *out; 382 size_t ciphertext_len; 383 if (!ssl_write_buffer_init(ssl, &out, max_out) || 384 !dtls_seal_record(ssl, out, &ciphertext_len, max_out, type, buf, len, 385 use_epoch)) { 386 ssl_write_buffer_clear(ssl); 387 return -1; 388 } 389 ssl_write_buffer_set_len(ssl, ciphertext_len); 390 391 int ret = ssl_write_buffer_flush(ssl); 392 if (ret <= 0) { 393 return ret; 394 } 395 return 1; 396} 397 398int dtls1_dispatch_alert(SSL *ssl) { 399 ssl->s3->alert_dispatch = 0; 400 int ret = dtls1_write_record(ssl, SSL3_RT_ALERT, &ssl->s3->send_alert[0], 2, 401 dtls1_use_current_epoch); 402 if (ret <= 0) { 403 ssl->s3->alert_dispatch = 1; 404 return ret; 405 } 406 407 /* If the alert is fatal, flush the BIO now. */ 408 if (ssl->s3->send_alert[0] == SSL3_AL_FATAL) { 409 BIO_flush(ssl->wbio); 410 } 411 412 ssl_do_msg_callback(ssl, 1 /* write */, ssl->version, SSL3_RT_ALERT, 413 ssl->s3->send_alert, 2); 414 415 int alert = (ssl->s3->send_alert[0] << 8) | ssl->s3->send_alert[1]; 416 ssl_do_info_callback(ssl, SSL_CB_WRITE_ALERT, alert); 417 418 return 1; 419} 420