/* ssl/d1_pkt.c */

/* 

 * DTLS implementation written by Nagendra Modadugu

 * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  

 */

/* ====================================================================

 * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 *

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer. 

 *

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in

 *    the documentation and/or other materials provided with the

 *    distribution.

 *

 * 3. All advertising materials mentioning features or use of this

 *    software must display the following acknowledgment:

 *    "This product includes software developed by the OpenSSL Project

 *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"

 *

 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

 *    endorse or promote products derived from this software without

 *    prior written permission. For written permission, please contact

 *    openssl-core@openssl.org.

 *

 * 5. Products derived from this software may not be called "OpenSSL"

 *    nor may "OpenSSL" appear in their names without prior written

 *    permission of the OpenSSL Project.

 *

 * 6. Redistributions of any form whatsoever must retain the following

 *    acknowledgment:

 *    "This product includes software developed by the OpenSSL Project

 *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"

 *

 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

 * OF THE POSSIBILITY OF SUCH DAMAGE.

 * ====================================================================

 *

 * This product includes cryptographic software written by Eric Young

 * (eay@cryptsoft.com).  This product includes software written by Tim

 * Hudson (tjh@cryptsoft.com).

 *

 */

/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)

 * All rights reserved.

 *

 * This package is an SSL implementation written

 * by Eric Young (eay@cryptsoft.com).

 * The implementation was written so as to conform with Netscapes SSL.

 * 

 * This library is free for commercial and non-commercial use as long as

 * the following conditions are aheared to.  The following conditions

 * apply to all code found in this distribution, be it the RC4, RSA,

 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation

 * included with this distribution is covered by the same copyright terms

 * except that the holder is Tim Hudson (tjh@cryptsoft.com).

 * 

 * Copyright remains Eric Young's, and as such any Copyright notices in

 * the code are not to be removed.

 * If this package is used in a product, Eric Young should be given attribution

 * as the author of the parts of the library used.

 * This can be in the form of a textual message at program startup or

 * in documentation (online or textual) provided with the package.

 * 

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 1. Redistributions of source code must retain the copyright

 *    notice, this list of conditions and the following disclaimer.

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in the

 *    documentation and/or other materials provided with the distribution.

 * 3. All advertising materials mentioning features or use of this software

 *    must display the following acknowledgement:

 *    "This product includes cryptographic software written by

 *     Eric Young (eay@cryptsoft.com)"

 *    The word 'cryptographic' can be left out if the rouines from the library

 *    being used are not cryptographic related :-).

 * 4. If you include any Windows specific code (or a derivative thereof) from 

 *    the apps directory (application code) you must include an acknowledgement:

 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"

 * 

 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND

 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE

 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

 * SUCH DAMAGE.

 * 

 * The licence and distribution terms for any publically available version or

 * derivative of this code cannot be changed.  i.e. this code cannot simply be

 * copied and put under another distribution licence

 * [including the GNU Public Licence.]

 */

#include <stdio.h>

#include <errno.h>

#define USE_SOCKETS

#include "ssl_locl.h"

#include <openssl/evp.h>

#include <openssl/buffer.h>

#include <openssl/pqueue.h>

#include <openssl/rand.h>

static int have_handshake_fragment(SSL *s, int type, unsigned char *buf, 

	int len, int peek);

static int dtls1_record_replay_check(SSL *s, DTLS1_BITMAP *bitmap,

	PQ_64BIT *seq_num);

static void dtls1_record_bitmap_update(SSL *s, DTLS1_BITMAP *bitmap);

static DTLS1_BITMAP *dtls1_get_bitmap(SSL *s, SSL3_RECORD *rr, 

    unsigned int *is_next_epoch);

#if 0

static int dtls1_record_needs_buffering(SSL *s, SSL3_RECORD *rr,

	unsigned short *priority, unsigned long *offset);

#endif

static int dtls1_buffer_record(SSL *s, record_pqueue *q,

	PQ_64BIT priority);

static int dtls1_process_record(SSL *s);

#if PQ_64BIT_IS_INTEGER

static PQ_64BIT bytes_to_long_long(unsigned char *bytes, PQ_64BIT *num);

#endif

static void dtls1_clear_timeouts(SSL *s);

/* copy buffered record into SSL structure */

static int

dtls1_copy_record(SSL *s, pitem *item)

    {

    DTLS1_RECORD_DATA *rdata;

    rdata = (DTLS1_RECORD_DATA *)item->data;

    if (s->s3->rbuf.buf != NULL)

        OPENSSL_free(s->s3->rbuf.buf);

    s->packet = rdata->packet;

    s->packet_length = rdata->packet_length;

    memcpy(&(s->s3->rbuf), &(rdata->rbuf), sizeof(SSL3_BUFFER));

    memcpy(&(s->s3->rrec), &(rdata->rrec), sizeof(SSL3_RECORD));

    return(1);

    }

static int

dtls1_buffer_record(SSL *s, record_pqueue *queue, PQ_64BIT priority)

{

    DTLS1_RECORD_DATA *rdata;

	pitem *item;

	rdata = OPENSSL_malloc(sizeof(DTLS1_RECORD_DATA));

	item = pitem_new(priority, rdata);

	if (rdata == NULL || item == NULL)

		{

		if (rdata != NULL) OPENSSL_free(rdata);

		if (item != NULL) pitem_free(item);

		SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);

		return(0);

		}

	rdata->packet = s->packet;

	rdata->packet_length = s->packet_length;

	memcpy(&(rdata->rbuf), &(s->s3->rbuf), sizeof(SSL3_BUFFER));

	memcpy(&(rdata->rrec), &(s->s3->rrec), sizeof(SSL3_RECORD));

	item->data = rdata;

	/* insert should not fail, since duplicates are dropped */

	if (pqueue_insert(queue->q, item) == NULL)

		{

		OPENSSL_free(rdata);

		pitem_free(item);

		return(0);

		}

	s->packet = NULL;

	s->packet_length = 0;

	memset(&(s->s3->rbuf), 0, sizeof(SSL3_BUFFER));

	memset(&(s->s3->rrec), 0, sizeof(SSL3_RECORD));

	if (!ssl3_setup_buffers(s))

		{

		SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);

		OPENSSL_free(rdata);

		pitem_free(item);

		return(0);

		}

	return(1);

    }

static int

dtls1_retrieve_buffered_record(SSL *s, record_pqueue *queue)

    {

    pitem *item;

    item = pqueue_pop(queue->q);

    if (item)

        {

        dtls1_copy_record(s, item);

        OPENSSL_free(item->data);

		pitem_free(item);

        return(1);

        }

    return(0);

    }

/* retrieve a buffered record that belongs to the new epoch, i.e., not processed 

 * yet */

#define dtls1_get_unprocessed_record(s) \

                   dtls1_retrieve_buffered_record((s), \

                   &((s)->d1->unprocessed_rcds))

/* retrieve a buffered record that belongs to the current epoch, ie, processed */

#define dtls1_get_processed_record(s) \

                   dtls1_retrieve_buffered_record((s), \

                   &((s)->d1->processed_rcds))

static int

dtls1_process_buffered_records(SSL *s)

    {

    pitem *item;

    item = pqueue_peek(s->d1->unprocessed_rcds.q);

    if (item)

        {

        DTLS1_RECORD_DATA *rdata;

        rdata = (DTLS1_RECORD_DATA *)item->data;

        /* Check if epoch is current. */

        if (s->d1->unprocessed_rcds.epoch != s->d1->r_epoch)

            return(1);  /* Nothing to do. */

        /* Process all the records. */

        while (pqueue_peek(s->d1->unprocessed_rcds.q))

            {

            dtls1_get_unprocessed_record(s);

            if ( ! dtls1_process_record(s))

                return(0);

            dtls1_buffer_record(s, &(s->d1->processed_rcds), 

                s->s3->rrec.seq_num);

            }

        }

    /* sync epoch numbers once all the unprocessed records 

     * have been processed */

    s->d1->processed_rcds.epoch = s->d1->r_epoch;

    s->d1->unprocessed_rcds.epoch = s->d1->r_epoch + 1;

    return(1);

    }

#if 0

static int

dtls1_get_buffered_record(SSL *s)

	{

	pitem *item;

	PQ_64BIT priority = 

		(((PQ_64BIT)s->d1->handshake_read_seq) << 32) | 

		((PQ_64BIT)s->d1->r_msg_hdr.frag_off);

	if ( ! SSL_in_init(s))  /* if we're not (re)negotiating, 

							   nothing buffered */

		return 0;

	item = pqueue_peek(s->d1->rcvd_records);

	if (item && item->priority == priority)

		{

		/* Check if we've received the record of interest.  It must be

		 * a handshake record, since data records as passed up without

		 * buffering */

		DTLS1_RECORD_DATA *rdata;

		item = pqueue_pop(s->d1->rcvd_records);

		rdata = (DTLS1_RECORD_DATA *)item->data;

		if (s->s3->rbuf.buf != NULL)

			OPENSSL_free(s->s3->rbuf.buf);

		s->packet = rdata->packet;

		s->packet_length = rdata->packet_length;

		memcpy(&(s->s3->rbuf), &(rdata->rbuf), sizeof(SSL3_BUFFER));

		memcpy(&(s->s3->rrec), &(rdata->rrec), sizeof(SSL3_RECORD));

		OPENSSL_free(item->data);

		pitem_free(item);

		/* s->d1->next_expected_seq_num++; */

		return(1);

		}

	return 0;

	}

#endif

static int

dtls1_process_record(SSL *s)

{

    int i,al;

	int clear=0;

    int enc_err;

	SSL_SESSION *sess;

    SSL3_RECORD *rr;

	unsigned int mac_size;

	unsigned char md[EVP_MAX_MD_SIZE];

	rr= &(s->s3->rrec);

    sess = s->session;

	/* At this point, s->packet_length == SSL3_RT_HEADER_LNGTH + rr->length,

	 * and we have that many bytes in s->packet

	 */

	rr->input= &(s->packet[DTLS1_RT_HEADER_LENGTH]);

	/* ok, we can now read from 's->packet' data into 'rr'

	 * rr->input points at rr->length bytes, which

	 * need to be copied into rr->data by either

	 * the decryption or by the decompression

	 * When the data is 'copied' into the rr->data buffer,

	 * rr->input will be pointed at the new buffer */ 

	/* We now have - encrypted [ MAC [ compressed [ plain ] ] ]

	 * rr->length bytes of encrypted compressed stuff. */

	/* check is not needed I believe */

	if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH)

		{

		al=SSL_AD_RECORD_OVERFLOW;

		SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_ENCRYPTED_LENGTH_TOO_LONG);

		goto f_err;

		}

	/* decrypt in place in 'rr->input' */

	rr->data=rr->input;

	enc_err = s->method->ssl3_enc->enc(s,0);

	if (enc_err <= 0)

		{

		if (enc_err == 0)

			/* SSLerr() and ssl3_send_alert() have been called */

			goto err;

		/* otherwise enc_err == -1 */

		goto decryption_failed_or_bad_record_mac;

		}

#ifdef TLS_DEBUG

printf("dec %d\n",rr->length);

{ unsigned int z; for (z=0; z<rr->length; z++) printf("%02X%c",rr->data[z],((z+1)%16)?' ':'\n'); }

printf("\n");

#endif

	/* r->length is now the compressed data plus mac */

if (	(sess == NULL) ||

		(s->enc_read_ctx == NULL) ||

		(s->read_hash == NULL))

    clear=1;

	if (!clear)

		{

		mac_size=EVP_MD_size(s->read_hash);

		if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+mac_size)

			{

#if 0 /* OK only for stream ciphers (then rr->length is visible from ciphertext anyway) */

			al=SSL_AD_RECORD_OVERFLOW;

			SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);

			goto f_err;

#else

			goto decryption_failed_or_bad_record_mac;

#endif			

			}

		/* check the MAC for rr->input (it's in mac_size bytes at the tail) */

		if (rr->length < mac_size)

			{

#if 0 /* OK only for stream ciphers */

			al=SSL_AD_DECODE_ERROR;

			SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_LENGTH_TOO_SHORT);

			goto f_err;

#else

			goto decryption_failed_or_bad_record_mac;

#endif

			}

		rr->length-=mac_size;

		i=s->method->ssl3_enc->mac(s,md,0);

		if (memcmp(md,&(rr->data[rr->length]),mac_size) != 0)

			{

			goto decryption_failed_or_bad_record_mac;

			}

		}

	/* r->length is now just compressed */

	if (s->expand != NULL)

		{

		if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH)

			{

			al=SSL_AD_RECORD_OVERFLOW;

			SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_COMPRESSED_LENGTH_TOO_LONG);

			goto f_err;

			}

		if (!ssl3_do_uncompress(s))

			{

			al=SSL_AD_DECOMPRESSION_FAILURE;

			SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_BAD_DECOMPRESSION);

			goto f_err;

			}

		}

	if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH)

		{

		al=SSL_AD_RECORD_OVERFLOW;

		SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_DATA_LENGTH_TOO_LONG);

		goto f_err;

		}

	rr->off=0;

	/* So at this point the following is true

	 * ssl->s3->rrec.type 	is the type of record

	 * ssl->s3->rrec.length	== number of bytes in record

	 * ssl->s3->rrec.off	== offset to first valid byte

	 * ssl->s3->rrec.data	== where to take bytes from, increment

	 *			   after use :-).

	 */

	/* we have pulled in a full packet so zero things */

	s->packet_length=0;

    dtls1_record_bitmap_update(s, &(s->d1->bitmap));/* Mark receipt of record. */

    return(1);

decryption_failed_or_bad_record_mac:

	/* Separate 'decryption_failed' alert was introduced with TLS 1.0,

	 * SSL 3.0 only has 'bad_record_mac'.  But unless a decryption

	 * failure is directly visible from the ciphertext anyway,

	 * we should not reveal which kind of error occured -- this

	 * might become visible to an attacker (e.g. via logfile) */

	al=SSL_AD_BAD_RECORD_MAC;

	SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);

f_err:

	ssl3_send_alert(s,SSL3_AL_FATAL,al);

err:

	return(0);

}

/* Call this to get a new input record.

 * It will return <= 0 if more data is needed, normally due to an error

 * or non-blocking IO.

 * When it finishes, one packet has been decoded and can be found in

 * ssl->s3->rrec.type    - is the type of record

 * ssl->s3->rrec.data, 	 - data

 * ssl->s3->rrec.length, - number of bytes

 */

/* used only by dtls1_read_bytes */

int dtls1_get_record(SSL *s)

	{

	int ssl_major,ssl_minor,al;

	int i,n;

	SSL3_RECORD *rr;

	SSL_SESSION *sess;

	unsigned char *p;

	unsigned short version;

	DTLS1_BITMAP *bitmap;

	unsigned int is_next_epoch;

	rr= &(s->s3->rrec);

	sess=s->session;

    /* The epoch may have changed.  If so, process all the

     * pending records.  This is a non-blocking operation. */

    if ( ! dtls1_process_buffered_records(s))

        return 0;

	/* if we're renegotiating, then there may be buffered records */

	if (dtls1_get_processed_record(s))

		return 1;

	/* get something from the wire */

again:

	/* check if we have the header */

	if (	(s->rstate != SSL_ST_READ_BODY) ||

		(s->packet_length < DTLS1_RT_HEADER_LENGTH)) 

		{

		n=ssl3_read_n(s, DTLS1_RT_HEADER_LENGTH, s->s3->rbuf.len, 0);

		/* read timeout is handled by dtls1_read_bytes */

		if (n <= 0) return(n); /* error or non-blocking */

		OPENSSL_assert(s->packet_length == DTLS1_RT_HEADER_LENGTH);

		s->rstate=SSL_ST_READ_BODY;

		p=s->packet;

		/* Pull apart the header into the DTLS1_RECORD */

		rr->type= *(p++);

		ssl_major= *(p++);

		ssl_minor= *(p++);

		version=(ssl_major<<8)|ssl_minor;

		/* sequence number is 64 bits, with top 2 bytes = epoch */