/* ssl/s3_pkt.c */

/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)

 * All rights reserved.

 *

 * This package is an SSL implementation written

 * by Eric Young (eay@cryptsoft.com).

 * The implementation was written so as to conform with Netscapes SSL.

 * 

 * This library is free for commercial and non-commercial use as long as

 * the following conditions are aheared to.  The following conditions

 * apply to all code found in this distribution, be it the RC4, RSA,

 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation

 * included with this distribution is covered by the same copyright terms

 * except that the holder is Tim Hudson (tjh@cryptsoft.com).

 * 

 * Copyright remains Eric Young's, and as such any Copyright notices in

 * the code are not to be removed.

 * If this package is used in a product, Eric Young should be given attribution

 * as the author of the parts of the library used.

 * This can be in the form of a textual message at program startup or

 * in documentation (online or textual) provided with the package.

 * 

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 1. Redistributions of source code must retain the copyright

 *    notice, this list of conditions and the following disclaimer.

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in the

 *    documentation and/or other materials provided with the distribution.

 * 3. All advertising materials mentioning features or use of this software

 *    must display the following acknowledgement:

 *    "This product includes cryptographic software written by

 *     Eric Young (eay@cryptsoft.com)"

 *    The word 'cryptographic' can be left out if the rouines from the library

 *    being used are not cryptographic related :-).

 * 4. If you include any Windows specific code (or a derivative thereof) from 

 *    the apps directory (application code) you must include an acknowledgement:

 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"

 * 

 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND

 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE

 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

 * SUCH DAMAGE.

 * 

 * The licence and distribution terms for any publically available version or

 * derivative of this code cannot be changed.  i.e. this code cannot simply be

 * copied and put under another distribution licence

 * [including the GNU Public Licence.]

 */

/* ====================================================================

 * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 *

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer. 

 *

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in

 *    the documentation and/or other materials provided with the

 *    distribution.

 *

 * 3. All advertising materials mentioning features or use of this

 *    software must display the following acknowledgment:

 *    "This product includes software developed by the OpenSSL Project

 *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"

 *

 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

 *    endorse or promote products derived from this software without

 *    prior written permission. For written permission, please contact

 *    openssl-core@openssl.org.

 *

 * 5. Products derived from this software may not be called "OpenSSL"

 *    nor may "OpenSSL" appear in their names without prior written

 *    permission of the OpenSSL Project.

 *

 * 6. Redistributions of any form whatsoever must retain the following

 *    acknowledgment:

 *    "This product includes software developed by the OpenSSL Project

 *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"

 *

 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

 * OF THE POSSIBILITY OF SUCH DAMAGE.

 * ====================================================================

 *

 * This product includes cryptographic software written by Eric Young

 * (eay@cryptsoft.com).  This product includes software written by Tim

 * Hudson (tjh@cryptsoft.com).

 *

 */

#include <stdio.h>

#include <errno.h>

#define USE_SOCKETS

#include "ssl_locl.h"

#include <openssl/evp.h>

#include <openssl/buffer.h>

static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,

			 unsigned int len, int create_empty_fragment);

static int ssl3_get_record(SSL *s);

int ssl3_read_n(SSL *s, int n, int max, int extend)

	{

	/* If extend == 0, obtain new n-byte packet; if extend == 1, increase

	 * packet by another n bytes.

	 * The packet will be in the sub-array of s->s3->rbuf.buf specified

	 * by s->packet and s->packet_length.

	 * (If s->read_ahead is set, 'max' bytes may be stored in rbuf

	 * [plus s->packet_length bytes if extend == 1].)

	 */

	int i,off,newb;

	if (!extend)

		{

		/* start with empty packet ... */

		if (s->s3->rbuf.left == 0)

			s->s3->rbuf.offset = 0;

		s->packet = s->s3->rbuf.buf + s->s3->rbuf.offset;

		s->packet_length = 0;

		/* ... now we can act as if 'extend' was set */

		}

	/* extend reads should not span multiple packets for DTLS */

	if ( SSL_version(s) == DTLS1_VERSION &&

		extend)

		{

		if ( s->s3->rbuf.left > 0 && n > s->s3->rbuf.left)

			n = s->s3->rbuf.left;

		}

	/* if there is enough in the buffer from a previous read, take some */

	if (s->s3->rbuf.left >= (int)n)

		{

		s->packet_length+=n;

		s->s3->rbuf.left-=n;

		s->s3->rbuf.offset+=n;

		return(n);

		}

	/* else we need to read more data */

	if (!s->read_ahead)

		max=n;

	{

		/* avoid buffer overflow */

		int max_max = s->s3->rbuf.len - s->packet_length;

		if (max > max_max)

			max = max_max;

	}

	if (n > max) /* does not happen */

		{

		SSLerr(SSL_F_SSL3_READ_N,ERR_R_INTERNAL_ERROR);

		return -1;

		}

	off = s->packet_length;

	newb = s->s3->rbuf.left;

	/* Move any available bytes to front of buffer:

	 * 'off' bytes already pointed to by 'packet',

	 * 'newb' extra ones at the end */

	if (s->packet != s->s3->rbuf.buf)

		{

		/*  off > 0 */

		memmove(s->s3->rbuf.buf, s->packet, off+newb);

		s->packet = s->s3->rbuf.buf;

		}

	while (newb < n)

		{

		/* Now we have off+newb bytes at the front of s->s3->rbuf.buf and need

		 * to read in more until we have off+n (up to off+max if possible) */

		clear_sys_error();

		if (s->rbio != NULL)

			{

			s->rwstate=SSL_READING;

			i=BIO_read(s->rbio,	&(s->s3->rbuf.buf[off+newb]), max-newb);

			}

		else

			{

			SSLerr(SSL_F_SSL3_READ_N,SSL_R_READ_BIO_NOT_SET);

			i = -1;

			}

		if (i <= 0)

			{

			s->s3->rbuf.left = newb;

			return(i);

			}

		newb+=i;

		}

	/* done reading, now the book-keeping */

	s->s3->rbuf.offset = off + n;

	s->s3->rbuf.left = newb - n;

	s->packet_length += n;

	s->rwstate=SSL_NOTHING;

	return(n);

	}

/* Call this to get a new input record.

 * It will return <= 0 if more data is needed, normally due to an error

 * or non-blocking IO.

 * When it finishes, one packet has been decoded and can be found in

 * ssl->s3->rrec.type    - is the type of record

 * ssl->s3->rrec.data, 	 - data

 * ssl->s3->rrec.length, - number of bytes

 */

/* used only by ssl3_read_bytes */

static int ssl3_get_record(SSL *s)

	{

	int ssl_major,ssl_minor,al;

	int enc_err,n,i,ret= -1;

	SSL3_RECORD *rr;

	SSL_SESSION *sess;

	unsigned char *p;

	unsigned char md[EVP_MAX_MD_SIZE];

	short version;

	unsigned int mac_size;

	int clear=0;

	size_t extra;

	int decryption_failed_or_bad_record_mac = 0;

	unsigned char *mac = NULL;

	rr= &(s->s3->rrec);

	sess=s->session;

	if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)

		extra=SSL3_RT_MAX_EXTRA;

	else

		extra=0;

	if (extra != s->s3->rbuf.len - SSL3_RT_MAX_PACKET_SIZE)

		{

		/* actually likely an application error: SLS_OP_MICROSOFT_BIG_SSLV3_BUFFER

		 * set after ssl3_setup_buffers() was done */

		SSLerr(SSL_F_SSL3_GET_RECORD, ERR_R_INTERNAL_ERROR);

		return -1;

		}

again:

	/* check if we have the header */

	if (	(s->rstate != SSL_ST_READ_BODY) ||

		(s->packet_length < SSL3_RT_HEADER_LENGTH)) 

		{

		n=ssl3_read_n(s, SSL3_RT_HEADER_LENGTH, s->s3->rbuf.len, 0);

		if (n <= 0) return(n); /* error or non-blocking */

		s->rstate=SSL_ST_READ_BODY;

		p=s->packet;

		/* Pull apart the header into the SSL3_RECORD */

		rr->type= *(p++);

		ssl_major= *(p++);

		ssl_minor= *(p++);

		version=(ssl_major<<8)|ssl_minor;

		n2s(p,rr->length);

		/* Lets check version */

		if (!s->first_packet)

			{

			if (version != s->version)

				{

				SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);

				/* Send back error using their

				 * version number :-) */

				s->version=version;

				al=SSL_AD_PROTOCOL_VERSION;

				goto f_err;

				}

			}

		if ((version>>8) != SSL3_VERSION_MAJOR)

			{

			SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);

			goto err;

			}

		if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH+extra)

			{

			al=SSL_AD_RECORD_OVERFLOW;

			SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_PACKET_LENGTH_TOO_LONG);

			goto f_err;

			}

		/* now s->rstate == SSL_ST_READ_BODY */

		}

	/* s->rstate == SSL_ST_READ_BODY, get and decode the data */

	if (rr->length > s->packet_length-SSL3_RT_HEADER_LENGTH)

		{

		/* now s->packet_length == SSL3_RT_HEADER_LENGTH */

		i=rr->length;

		n=ssl3_read_n(s,i,i,1);

		if (n <= 0) return(n); /* error or non-blocking io */

		/* now n == rr->length,

		 * and s->packet_length == SSL3_RT_HEADER_LENGTH + rr->length */

		}

	s->rstate=SSL_ST_READ_HEADER; /* set state for later operations */

	/* At this point, s->packet_length == SSL3_RT_HEADER_LNGTH + rr->length,

	 * and we have that many bytes in s->packet

	 */

	rr->input= &(s->packet[SSL3_RT_HEADER_LENGTH]);

	/* ok, we can now read from 's->packet' data into 'rr'

	 * rr->input points at rr->length bytes, which

	 * need to be copied into rr->data by either

	 * the decryption or by the decompression

	 * When the data is 'copied' into the rr->data buffer,

	 * rr->input will be pointed at the new buffer */ 

	/* We now have - encrypted [ MAC [ compressed [ plain ] ] ]

	 * rr->length bytes of encrypted compressed stuff. */

	/* check is not needed I believe */

	if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH+extra)

		{

		al=SSL_AD_RECORD_OVERFLOW;

		SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_ENCRYPTED_LENGTH_TOO_LONG);

		goto f_err;

		}

	/* decrypt in place in 'rr->input' */

	rr->data=rr->input;

	enc_err = s->method->ssl3_enc->enc(s,0);

	if (enc_err <= 0)

		{

		if (enc_err == 0)

			/* SSLerr() and ssl3_send_alert() have been called */

			goto err;

		/* Otherwise enc_err == -1, which indicates bad padding

		 * (rec->length has not been changed in this case).

		 * To minimize information leaked via timing, we will perform

		 * the MAC computation anyway. */

		decryption_failed_or_bad_record_mac = 1;

		}

#ifdef TLS_DEBUG

printf("dec %d\n",rr->length);

{ unsigned int z; for (z=0; z<rr->length; z++) printf("%02X%c",rr->data[z],((z+1)%16)?' ':'\n'); }

printf("\n");

#endif

	/* r->length is now the compressed data plus mac */

	if (	(sess == NULL) ||

		(s->enc_read_ctx == NULL) ||

		(s->read_hash == NULL))

		clear=1;

	if (!clear)

		{

		mac_size=EVP_MD_size(s->read_hash);

		if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra+mac_size)

			{

#if 0 /* OK only for stream ciphers (then rr->length is visible from ciphertext anyway) */

			al=SSL_AD_RECORD_OVERFLOW;

			SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);

			goto f_err;

#else

			decryption_failed_or_bad_record_mac = 1;

#endif			

			}

		/* check the MAC for rr->input (it's in mac_size bytes at the tail) */

		if (rr->length >= mac_size)

			{

			rr->length -= mac_size;

			mac = &rr->data[rr->length];

			}

		else

			{

			/* record (minus padding) is too short to contain a MAC */

#if 0 /* OK only for stream ciphers */

			al=SSL_AD_DECODE_ERROR;

			SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT);

			goto f_err;

#else

			decryption_failed_or_bad_record_mac = 1;

			rr->length = 0;

#endif

			}

		i=s->method->ssl3_enc->mac(s,md,0);

		if (mac == NULL || memcmp(md, mac, mac_size) != 0)

			{

			decryption_failed_or_bad_record_mac = 1;

			}

		}

	if (decryption_failed_or_bad_record_mac)

		{

		/* A separate 'decryption_failed' alert was introduced with TLS 1.0,

		 * SSL 3.0 only has 'bad_record_mac'.  But unless a decryption

		 * failure is directly visible from the ciphertext anyway,

		 * we should not reveal which kind of error occured -- this

		 * might become visible to an attacker (e.g. via a logfile) */

		al=SSL_AD_BAD_RECORD_MAC;

		SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);

		goto f_err;

		}

	/* r->length is now just compressed */

	if (s->expand != NULL)

		{

		if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra)

			{

			al=SSL_AD_RECORD_OVERFLOW;

			SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_COMPRESSED_LENGTH_TOO_LONG);

			goto f_err;

			}

		if (!ssl3_do_uncompress(s))

			{

			al=SSL_AD_DECOMPRESSION_FAILURE;

			SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_BAD_DECOMPRESSION);

			goto f_err;

			}

		}

	if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH+extra)

		{

		al=SSL_AD_RECORD_OVERFLOW;

		SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_DATA_LENGTH_TOO_LONG);

		goto f_err;

		}

	rr->off=0;

	/* So at this point the following is true

	 * ssl->s3->rrec.type 	is the type of record

	 * ssl->s3->rrec.length	== number of bytes in record

	 * ssl->s3->rrec.off	== offset to first valid byte

	 * ssl->s3->rrec.data	== where to take bytes from, increment

	 *			   after use :-).

	 */

	/* we have pulled in a full packet so zero things */

	s->packet_length=0;

	/* just read a 0 length packet */

	if (rr->length == 0) goto again;

	return(1);

f_err:

	ssl3_send_alert(s,SSL3_AL_FATAL,al);

err:

	return(ret);

	}

int ssl3_do_uncompress(SSL *ssl)

	{

#ifndef OPENSSL_NO_COMP

	int i;

	SSL3_RECORD *rr;

	rr= &(ssl->s3->rrec);

	i=COMP_expand_block(ssl->expand,rr->comp,

		SSL3_RT_MAX_PLAIN_LENGTH,rr->data,(int)rr->length);

	if (i < 0)

		return(0);

	else

		rr->length=i;

	rr->data=rr->comp;

#endif

	return(1);

	}

int ssl3_do_compress(SSL *ssl)

	{

#ifndef OPENSSL_NO_COMP

	int i;

	SSL3_RECORD *wr;

	wr= &(ssl->s3->wrec);

	i=COMP_compress_block(ssl->compress,wr->data,

		SSL3_RT_MAX_COMPRESSED_LENGTH,

		wr->input,(int)wr->length);

	if (i < 0)

		return(0);

	else

		wr->length=i;

	wr->input=wr->data;

#endif

	return(1);

	}

/* Call this to write data in records of type 'type'

 * It will return <= 0 if not all data has been sent or non-blocking IO.

 */

int ssl3_write_bytes(SSL *s, int type, const void *buf_, int len)

	{

	const unsigned char *buf=buf_;

	unsigned int tot,n,nw;

	int i;

	s->rwstate=SSL_NOTHING;

	tot=s->s3->wnum;

	s->s3->wnum=0;

	if (SSL_in_init(s) && !s->in_handshake)

		{

		i=s->handshake_func(s);

		if (i < 0) return(i);

		if (i == 0)