1 /* ssl/s3_pkt.c */

     2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)

     3  * All rights reserved.

     4  *

     5  * This package is an SSL implementation written

     6  * by Eric Young (eay@cryptsoft.com).

     7  * The implementation was written so as to conform with Netscapes SSL.

     8  * 

     9  * This library is free for commercial and non-commercial use as long as

    10  * the following conditions are aheared to.  The following conditions

    11  * apply to all code found in this distribution, be it the RC4, RSA,

    12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation

    13  * included with this distribution is covered by the same copyright terms

    14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).

    15  * 

    16  * Copyright remains Eric Young's, and as such any Copyright notices in

    17  * the code are not to be removed.

    18  * If this package is used in a product, Eric Young should be given attribution

    19  * as the author of the parts of the library used.

    20  * This can be in the form of a textual message at program startup or

    21  * in documentation (online or textual) provided with the package.

    22  * 

    23  * Redistribution and use in source and binary forms, with or without

    24  * modification, are permitted provided that the following conditions

    25  * are met:

    26  * 1. Redistributions of source code must retain the copyright

    27  *    notice, this list of conditions and the following disclaimer.

    28  * 2. Redistributions in binary form must reproduce the above copyright

    29  *    notice, this list of conditions and the following disclaimer in the

    30  *    documentation and/or other materials provided with the distribution.

    31  * 3. All advertising materials mentioning features or use of this software

    32  *    must display the following acknowledgement:

    33  *    "This product includes cryptographic software written by

    34  *     Eric Young (eay@cryptsoft.com)"

    35  *    The word 'cryptographic' can be left out if the rouines from the library

    36  *    being used are not cryptographic related :-).

    37  * 4. If you include any Windows specific code (or a derivative thereof) from 

    38  *    the apps directory (application code) you must include an acknowledgement:

    39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"

    40  * 

    41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND

    42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

    43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

    44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE

    45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

    46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

    47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

    48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

    49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

    50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

    51  * SUCH DAMAGE.

    52  * 

    53  * The licence and distribution terms for any publically available version or

    54  * derivative of this code cannot be changed.  i.e. this code cannot simply be

    55  * copied and put under another distribution licence

    56  * [including the GNU Public Licence.]

    57  */

    58 /* ====================================================================

    59  * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.

    60  *

    61  * Redistribution and use in source and binary forms, with or without

    62  * modification, are permitted provided that the following conditions

    63  * are met:

    64  *

    65  * 1. Redistributions of source code must retain the above copyright

    66  *    notice, this list of conditions and the following disclaimer. 

    67  *

    68  * 2. Redistributions in binary form must reproduce the above copyright

    69  *    notice, this list of conditions and the following disclaimer in

    70  *    the documentation and/or other materials provided with the

    71  *    distribution.

    72  *

    73  * 3. All advertising materials mentioning features or use of this

    74  *    software must display the following acknowledgment:

    75  *    "This product includes software developed by the OpenSSL Project

    76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"

    77  *

    78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

    79  *    endorse or promote products derived from this software without

    80  *    prior written permission. For written permission, please contact

    81  *    openssl-core@openssl.org.

    82  *

    83  * 5. Products derived from this software may not be called "OpenSSL"

    84  *    nor may "OpenSSL" appear in their names without prior written

    85  *    permission of the OpenSSL Project.

    86  *

    87  * 6. Redistributions of any form whatsoever must retain the following

    88  *    acknowledgment:

    89  *    "This product includes software developed by the OpenSSL Project

    90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"

    91  *

    92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

    93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

    94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

    95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

    96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

    97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

    98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

    99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

   100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

   101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

   102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

   103  * OF THE POSSIBILITY OF SUCH DAMAGE.

   104  * ====================================================================

   105  *

   106  * This product includes cryptographic software written by Eric Young

   107  * (eay@cryptsoft.com).  This product includes software written by Tim

   108  * Hudson (tjh@cryptsoft.com).

   109  *

   110  */

   111 

   112 #include <stdio.h>

   113 #include <errno.h>

   114 #define USE_SOCKETS

   115 #include "ssl_locl.h"

   116 #include <openssl/evp.h>

   117 #include <openssl/buffer.h>

   118 

   119 static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,

   120 			 unsigned int len, int create_empty_fragment);

   121 static int ssl3_get_record(SSL *s);

   122 

   123 int ssl3_read_n(SSL *s, int n, int max, int extend)

   124 	{

   125 	/* If extend == 0, obtain new n-byte packet; if extend == 1, increase

   126 	 * packet by another n bytes.

   127 	 * The packet will be in the sub-array of s->s3->rbuf.buf specified

   128 	 * by s->packet and s->packet_length.

   129 	 * (If s->read_ahead is set, 'max' bytes may be stored in rbuf

   130 	 * [plus s->packet_length bytes if extend == 1].)

   131 	 */

   132 	int i,off,newb;

   133 

   134 	if (!extend)

   135 		{

   136 		/* start with empty packet ... */

   137 		if (s->s3->rbuf.left == 0)

   138 			s->s3->rbuf.offset = 0;

   139 		s->packet = s->s3->rbuf.buf + s->s3->rbuf.offset;

   140 		s->packet_length = 0;

   141 		/* ... now we can act as if 'extend' was set */

   142 		}

   143 

   144 	/* extend reads should not span multiple packets for DTLS */

   145 	if ( SSL_version(s) == DTLS1_VERSION &&

   146 		extend)

   147 		{

   148 		if ( s->s3->rbuf.left > 0 && n > s->s3->rbuf.left)

   149 			n = s->s3->rbuf.left;

   150 		}

   151 

   152 	/* if there is enough in the buffer from a previous read, take some */

   153 	if (s->s3->rbuf.left >= (int)n)

   154 		{

   155 		s->packet_length+=n;

   156 		s->s3->rbuf.left-=n;

   157 		s->s3->rbuf.offset+=n;

   158 		return(n);

   159 		}

   160 

   161 	/* else we need to read more data */

   162 	if (!s->read_ahead)

   163 		max=n;

   164 

   165 	{

   166 		/* avoid buffer overflow */

   167 		int max_max = s->s3->rbuf.len - s->packet_length;

   168 		if (max > max_max)

   169 			max = max_max;

   170 	}

   171 	if (n > max) /* does not happen */

   172 		{

   173 		SSLerr(SSL_F_SSL3_READ_N,ERR_R_INTERNAL_ERROR);

   174 		return -1;

   175 		}

   176 

   177 	off = s->packet_length;

   178 	newb = s->s3->rbuf.left;

   179 	/* Move any available bytes to front of buffer:

   180 	 * 'off' bytes already pointed to by 'packet',

   181 	 * 'newb' extra ones at the end */

   182 	if (s->packet != s->s3->rbuf.buf)

   183 		{

   184 		/*  off > 0 */

   185 		memmove(s->s3->rbuf.buf, s->packet, off+newb);

   186 		s->packet = s->s3->rbuf.buf;

   187 		}

   188 

   189 	while (newb < n)

   190 		{

   191 		/* Now we have off+newb bytes at the front of s->s3->rbuf.buf and need

   192 		 * to read in more until we have off+n (up to off+max if possible) */

   193 

   194 		clear_sys_error();

   195 		if (s->rbio != NULL)

   196 			{

   197 			s->rwstate=SSL_READING;

   198 			i=BIO_read(s->rbio,	&(s->s3->rbuf.buf[off+newb]), max-newb);

   199 			}

   200 		else

   201 			{

   202 			SSLerr(SSL_F_SSL3_READ_N,SSL_R_READ_BIO_NOT_SET);

   203 			i = -1;

   204 			}

   205 

   206 		if (i <= 0)

   207 			{

   208 			s->s3->rbuf.left = newb;

   209 			return(i);

   210 			}

   211 		newb+=i;

   212 		}

   213 

   214 	/* done reading, now the book-keeping */

   215 	s->s3->rbuf.offset = off + n;

   216 	s->s3->rbuf.left = newb - n;

   217 	s->packet_length += n;

   218 	s->rwstate=SSL_NOTHING;

   219 	return(n);

   220 	}

   221 

   222 /* Call this to get a new input record.

   223  * It will return <= 0 if more data is needed, normally due to an error

   224  * or non-blocking IO.

   225  * When it finishes, one packet has been decoded and can be found in

   226  * ssl->s3->rrec.type    - is the type of record

   227  * ssl->s3->rrec.data, 	 - data

   228  * ssl->s3->rrec.length, - number of bytes

   229  */

   230 /* used only by ssl3_read_bytes */

   231 static int ssl3_get_record(SSL *s)

   232 	{

   233 	int ssl_major,ssl_minor,al;

   234 	int enc_err,n,i,ret= -1;

   235 	SSL3_RECORD *rr;

   236 	SSL_SESSION *sess;

   237 	unsigned char *p;

   238 	unsigned char md[EVP_MAX_MD_SIZE];

   239 	short version;

   240 	unsigned int mac_size;

   241 	int clear=0;

   242 	size_t extra;

   243 	int decryption_failed_or_bad_record_mac = 0;

   244 	unsigned char *mac = NULL;

   245 

   246 	rr= &(s->s3->rrec);

   247 	sess=s->session;

   248 

   249 	if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)

   250 		extra=SSL3_RT_MAX_EXTRA;

   251 	else

   252 		extra=0;

   253 	if (extra != s->s3->rbuf.len - SSL3_RT_MAX_PACKET_SIZE)

   254 		{

   255 		/* actually likely an application error: SLS_OP_MICROSOFT_BIG_SSLV3_BUFFER

   256 		 * set after ssl3_setup_buffers() was done */

   257 		SSLerr(SSL_F_SSL3_GET_RECORD, ERR_R_INTERNAL_ERROR);

   258 		return -1;

   259 		}

   260 

   261 again:

   262 	/* check if we have the header */

   263 	if (	(s->rstate != SSL_ST_READ_BODY) ||

   264 		(s->packet_length < SSL3_RT_HEADER_LENGTH)) 

   265 		{

   266 		n=ssl3_read_n(s, SSL3_RT_HEADER_LENGTH, s->s3->rbuf.len, 0);

   267 		if (n <= 0) return(n); /* error or non-blocking */

   268 		s->rstate=SSL_ST_READ_BODY;

   269 

   270 		p=s->packet;

   271 

   272 		/* Pull apart the header into the SSL3_RECORD */

   273 		rr->type= *(p++);

   274 		ssl_major= *(p++);

   275 		ssl_minor= *(p++);

   276 		version=(ssl_major<<8)|ssl_minor;

   277 		n2s(p,rr->length);

   278 

   279 		/* Lets check version */

   280 		if (!s->first_packet)

   281 			{

   282 			if (version != s->version)

   283 				{

   284 				SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);

   285 				/* Send back error using their

   286 				 * version number :-) */

   287 				s->version=version;

   288 				al=SSL_AD_PROTOCOL_VERSION;

   289 				goto f_err;

   290 				}

   291 			}

   292 

   293 		if ((version>>8) != SSL3_VERSION_MAJOR)

   294 			{

   295 			SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);

   296 			goto err;

   297 			}

   298 

   299 		if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH+extra)

   300 			{

   301 			al=SSL_AD_RECORD_OVERFLOW;

   302 			SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_PACKET_LENGTH_TOO_LONG);

   303 			goto f_err;

   304 			}

   305 

   306 		/* now s->rstate == SSL_ST_READ_BODY */

   307 		}

   308 

   309 	/* s->rstate == SSL_ST_READ_BODY, get and decode the data */

   310 

   311 	if (rr->length > s->packet_length-SSL3_RT_HEADER_LENGTH)

   312 		{

   313 		/* now s->packet_length == SSL3_RT_HEADER_LENGTH */

   314 		i=rr->length;

   315 		n=ssl3_read_n(s,i,i,1);

   316 		if (n <= 0) return(n); /* error or non-blocking io */

   317 		/* now n == rr->length,

   318 		 * and s->packet_length == SSL3_RT_HEADER_LENGTH + rr->length */

   319 		}

   320 

   321 	s->rstate=SSL_ST_READ_HEADER; /* set state for later operations */

   322 

   323 	/* At this point, s->packet_length == SSL3_RT_HEADER_LNGTH + rr->length,

   324 	 * and we have that many bytes in s->packet

   325 	 */

   326 	rr->input= &(s->packet[SSL3_RT_HEADER_LENGTH]);

   327 

   328 	/* ok, we can now read from 's->packet' data into 'rr'

   329 	 * rr->input points at rr->length bytes, which

   330 	 * need to be copied into rr->data by either

   331 	 * the decryption or by the decompression

   332 	 * When the data is 'copied' into the rr->data buffer,

   333 	 * rr->input will be pointed at the new buffer */ 

   334 

   335 	/* We now have - encrypted [ MAC [ compressed [ plain ] ] ]

   336 	 * rr->length bytes of encrypted compressed stuff. */

   337 

   338 	/* check is not needed I believe */

   339 	if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH+extra)

   340 		{

   341 		al=SSL_AD_RECORD_OVERFLOW;

   342 		SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_ENCRYPTED_LENGTH_TOO_LONG);

   343 		goto f_err;

   344 		}

   345 

   346 	/* decrypt in place in 'rr->input' */

   347 	rr->data=rr->input;

   348 

   349 	enc_err = s->method->ssl3_enc->enc(s,0);

   350 	if (enc_err <= 0)

   351 		{

   352 		if (enc_err == 0)

   353 			/* SSLerr() and ssl3_send_alert() have been called */

   354 			goto err;

   355 

   356 		/* Otherwise enc_err == -1, which indicates bad padding

   357 		 * (rec->length has not been changed in this case).

   358 		 * To minimize information leaked via timing, we will perform

   359 		 * the MAC computation anyway. */

   360 		decryption_failed_or_bad_record_mac = 1;

   361 		}

   362 

   363 #ifdef TLS_DEBUG

   364 printf("dec %d\n",rr->length);

   365 { unsigned int z; for (z=0; z<rr->length; z++) printf("%02X%c",rr->data[z],((z+1)%16)?' ':'\n'); }

   366 printf("\n");

   367 #endif

   368 

   369 	/* r->length is now the compressed data plus mac */

   370 	if (	(sess == NULL) ||

   371 		(s->enc_read_ctx == NULL) ||

   372 		(s->read_hash == NULL))

   373 		clear=1;

   374 

   375 	if (!clear)

   376 		{

   377 		mac_size=EVP_MD_size(s->read_hash);

   378 

   379 		if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra+mac_size)

   380 			{

   381 #if 0 /* OK only for stream ciphers (then rr->length is visible from ciphertext anyway) */

   382 			al=SSL_AD_RECORD_OVERFLOW;

   383 			SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);

   384 			goto f_err;

   385 #else

   386 			decryption_failed_or_bad_record_mac = 1;

   387 #endif			

   388 			}

   389 		/* check the MAC for rr->input (it's in mac_size bytes at the tail) */

   390 		if (rr->length >= mac_size)

   391 			{

   392 			rr->length -= mac_size;

   393 			mac = &rr->data[rr->length];

   394 			}

   395 		else

   396 			{

   397 			/* record (minus padding) is too short to contain a MAC */

   398 #if 0 /* OK only for stream ciphers */

   399 			al=SSL_AD_DECODE_ERROR;

   400 			SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT);

   401 			goto f_err;

   402 #else

   403 			decryption_failed_or_bad_record_mac = 1;

   404 			rr->length = 0;

   405 #endif

   406 			}

   407 		i=s->method->ssl3_enc->mac(s,md,0);

   408 		if (mac == NULL || memcmp(md, mac, mac_size) != 0)

   409 			{

   410 			decryption_failed_or_bad_record_mac = 1;

   411 			}

   412 		}

   413 

   414 	if (decryption_failed_or_bad_record_mac)

   415 		{

   416 		/* A separate 'decryption_failed' alert was introduced with TLS 1.0,

   417 		 * SSL 3.0 only has 'bad_record_mac'.  But unless a decryption

   418 		 * failure is directly visible from the ciphertext anyway,

   419 		 * we should not reveal which kind of error occured -- this

   420 		 * might become visible to an attacker (e.g. via a logfile) */

   421 		al=SSL_AD_BAD_RECORD_MAC;

   422 		SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);

   423 		goto f_err;

   424 		}

   425 

   426 	/* r->length is now just compressed */

   427 	if (s->expand != NULL)

   428 		{

   429 		if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra)

   430 			{

   431 			al=SSL_AD_RECORD_OVERFLOW;

   432 			SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_COMPRESSED_LENGTH_TOO_LONG);

   433 			goto f_err;

   434 			}

   435 		if (!ssl3_do_uncompress(s))

   436 			{

   437 			al=SSL_AD_DECOMPRESSION_FAILURE;

   438 			SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_BAD_DECOMPRESSION);

   439 			goto f_err;

   440 			}

   441 		}

   442 

   443 	if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH+extra)

   444 		{

   445 		al=SSL_AD_RECORD_OVERFLOW;

   446 		SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_DATA_LENGTH_TOO_LONG);

   447 		goto f_err;

   448 		}

   449 

   450 	rr->off=0;

   451 	/* So at this point the following is true

   452 	 * ssl->s3->rrec.type 	is the type of record

   453 	 * ssl->s3->rrec.length	== number of bytes in record

   454 	 * ssl->s3->rrec.off	== offset to first valid byte

   455 	 * ssl->s3->rrec.data	== where to take bytes from, increment

   456 	 *			   after use :-).

   457 	 */

   458 

   459 	/* we have pulled in a full packet so zero things */

   460 	s->packet_length=0;

   461 

   462 	/* just read a 0 length packet */

   463 	if (rr->length == 0) goto again;

   464 

   465 	return(1);

   466 

   467 f_err:

   468 	ssl3_send_alert(s,SSL3_AL_FATAL,al);

   469 err:

   470 	return(ret);

   471 	}

   472 

   473 int ssl3_do_uncompress(SSL *ssl)

   474 	{

   475 #ifndef OPENSSL_NO_COMP

   476 	int i;

   477 	SSL3_RECORD *rr;

   478 

   479 	rr= &(ssl->s3->rrec);

   480 	i=COMP_expand_block(ssl->expand,rr->comp,

   481 		SSL3_RT_MAX_PLAIN_LENGTH,rr->data,(int)rr->length);

   482 	if (i < 0)

   483 		return(0);

   484 	else

   485 		rr->length=i;

   486 	rr->data=rr->comp;

   487 #endif

   488 	return(1);

   489 	}

   490 

   491 int ssl3_do_compress(SSL *ssl)

   492 	{

   493 #ifndef OPENSSL_NO_COMP

   494 	int i;

   495 	SSL3_RECORD *wr;

   496 

   497 	wr= &(ssl->s3->wrec);

   498 	i=COMP_compress_block(ssl->compress,wr->data,

   499 		SSL3_RT_MAX_COMPRESSED_LENGTH,

   500 		wr->input,(int)wr->length);

   501 	if (i < 0)

   502 		return(0);

   503 	else

   504 		wr->length=i;

   505 

   506 	wr->input=wr->data;

   507 #endif

   508 	return(1);

   509 	}

   510 

   511 /* Call this to write data in records of type 'type'

   512  * It will return <= 0 if not all data has been sent or non-blocking IO.

   513  */

   514 int ssl3_write_bytes(SSL *s, int type, const void *buf_, int len)

   515 	{

   516 	const unsigned char *buf=buf_;

   517 	unsigned int tot,n,nw;

   518 	int i;

   519 

   520 	s->rwstate=SSL_NOTHING;

   521 	tot=s->s3->wnum;

   522 	s->s3->wnum=0;

   523 

   524 	if (SSL_in_init(s) && !s->in_handshake)

   525 		{

   526 		i=s->handshake_func(s);

   527 		if (i < 0) return(i);

   528 		if (i == 0)

   529 			{

   530 			SSLerr(SSL_F_SSL3_WRITE_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);

   531 			return -1;

   532 			}

   533 		}

   534 

   535 	n=(len-tot);

   536 	for (;;)

   537 		{

   538 		if (n > SSL3_RT_MAX_PLAIN_LENGTH)

   539 			nw=SSL3_RT_MAX_PLAIN_LENGTH;

   540 		else

   541 			nw=n;

   542 

   543 		i=do_ssl3_write(s, type, &(buf[tot]), nw, 0);

   544 		if (i <= 0)

   545 			{

   546 			s->s3->wnum=tot;

   547 			return i;

   548 			}

   549 

   550 		if ((i == (int)n) ||

   551 			(type == SSL3_RT_APPLICATION_DATA &&

   552 			 (s->mode & SSL_MODE_ENABLE_PARTIAL_WRITE)))

   553 			{

   554 			/* next chunk of data should get another prepended empty fragment

   555 			 * in ciphersuites with known-IV weakness: */

   556 			s->s3->empty_fragment_done = 0;

   557 			

   558 			return tot+i;

   559 			}

   560 

   561 		n-=i;

   562 		tot+=i;

   563 		}

   564 	}

   565 

   566 static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,

   567 			 unsigned int len, int create_empty_fragment)

   568 	{

   569 	unsigned char *p,*plen;

   570 	int i,mac_size,clear=0;

   571 	int prefix_len = 0;

   572 	SSL3_RECORD *wr;

   573 	SSL3_BUFFER *wb;

   574 	SSL_SESSION *sess;

   575 

   576 	/* first check if there is a SSL3_BUFFER still being written

   577 	 * out.  This will happen with non blocking IO */

   578 	if (s->s3->wbuf.left != 0)

   579 		return(ssl3_write_pending(s,type,buf,len));

   580 

   581 	/* If we have an alert to send, lets send it */

   582 	if (s->s3->alert_dispatch)

   583 		{

   584 		i=s->method->ssl_dispatch_alert(s);

   585 		if (i <= 0)

   586 			return(i);

   587 		/* if it went, fall through and send more stuff */

   588 		}

   589 

   590 	if (len == 0 && !create_empty_fragment)

   591 		return 0;

   592 

   593 	wr= &(s->s3->wrec);

   594 	wb= &(s->s3->wbuf);

   595 	sess=s->session;

   596 

   597 	if (	(sess == NULL) ||

   598 		(s->enc_write_ctx == NULL) ||

   599 		(s->write_hash == NULL))

   600 		clear=1;

   601 

   602 	if (clear)

   603 		mac_size=0;

   604 	else

   605 		mac_size=EVP_MD_size(s->write_hash);

   606 

   607 	/* 'create_empty_fragment' is true only when this function calls itself */

   608 	if (!clear && !create_empty_fragment && !s->s3->empty_fragment_done)

   609 		{

   610 		/* countermeasure against known-IV weakness in CBC ciphersuites

   611 		 * (see http://www.openssl.org/~bodo/tls-cbc.txt) */

   612 

   613 		if (s->s3->need_empty_fragments && type == SSL3_RT_APPLICATION_DATA)

   614 			{

   615 			/* recursive function call with 'create_empty_fragment' set;

   616 			 * this prepares and buffers the data for an empty fragment

   617 			 * (these 'prefix_len' bytes are sent out later

   618 			 * together with the actual payload) */

   619 			prefix_len = do_ssl3_write(s, type, buf, 0, 1);

   620 			if (prefix_len <= 0)

   621 				goto err;

   622 

   623 			if (s->s3->wbuf.len < (size_t)prefix_len + SSL3_RT_MAX_PACKET_SIZE)

   624 				{

   625 				/* insufficient space */

   626 				SSLerr(SSL_F_DO_SSL3_WRITE, ERR_R_INTERNAL_ERROR);

   627 				goto err;

   628 				}

   629 			}

   630 		

   631 		s->s3->empty_fragment_done = 1;

   632 		}

   633 

   634 	p = wb->buf + prefix_len;

   635 

   636 	/* write the header */

   637 

   638 	*(p++)=type&0xff;

   639 	wr->type=type;

   640 

   641 	*(p++)=(s->version>>8);

   642 	*(p++)=s->version&0xff;

   643 

   644 	/* field where we are to write out packet length */

   645 	plen=p; 

   646 	p+=2;

   647 

   648 	/* lets setup the record stuff. */

   649 	wr->data=p;

   650 	wr->length=(int)len;

   651 	wr->input=(unsigned char *)buf;

   652 

   653 	/* we now 'read' from wr->input, wr->length bytes into

   654 	 * wr->data */

   655 

   656 	/* first we compress */

   657 	if (s->compress != NULL)

   658 		{

   659 		if (!ssl3_do_compress(s))

   660 			{

   661 			SSLerr(SSL_F_DO_SSL3_WRITE,SSL_R_COMPRESSION_FAILURE);

   662 			goto err;

   663 			}

   664 		}

   665 	else

   666 		{

   667 		memcpy(wr->data,wr->input,wr->length);

   668 		wr->input=wr->data;

   669 		}

   670 

   671 	/* we should still have the output to wr->data and the input

   672 	 * from wr->input.  Length should be wr->length.

   673 	 * wr->data still points in the wb->buf */

   674 

   675 	if (mac_size != 0)

   676 		{

   677 		s->method->ssl3_enc->mac(s,&(p[wr->length]),1);

   678 		wr->length+=mac_size;

   679 		wr->input=p;

   680 		wr->data=p;

   681 		}

   682 

   683 	/* ssl3_enc can only have an error on read */

   684 	s->method->ssl3_enc->enc(s,1);

   685 

   686 	/* record length after mac and block padding */

   687 	s2n(wr->length,plen);

   688 

   689 	/* we should now have

   690 	 * wr->data pointing to the encrypted data, which is

   691 	 * wr->length long */

   692 	wr->type=type; /* not needed but helps for debugging */

   693 	wr->length+=SSL3_RT_HEADER_LENGTH;

   694 

   695 	if (create_empty_fragment)

   696 		{

   697 		/* we are in a recursive call;

   698 		 * just return the length, don't write out anything here

   699 		 */

   700 		return wr->length;

   701 		}

   702 

   703 	/* now let's set up wb */

   704 	wb->left = prefix_len + wr->length;

   705 	wb->offset = 0;

   706 

   707 	/* memorize arguments so that ssl3_write_pending can detect bad write retries later */

   708 	s->s3->wpend_tot=len;

   709 	s->s3->wpend_buf=buf;

   710 	s->s3->wpend_type=type;

   711 	s->s3->wpend_ret=len;

   712 

   713 	/* we now just need to write the buffer */

   714 	return ssl3_write_pending(s,type,buf,len);

   715 err:

   716 	return -1;

   717 	}

   718 

   719 /* if s->s3->wbuf.left != 0, we need to call this */

   720 int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,

   721 	unsigned int len)

   722 	{

   723 	int i;

   724 

   725 /* XXXX */

   726 	if ((s->s3->wpend_tot > (int)len)

   727 		|| ((s->s3->wpend_buf != buf) &&

   728 			!(s->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER))

   729 		|| (s->s3->wpend_type != type))

   730 		{

   731 		SSLerr(SSL_F_SSL3_WRITE_PENDING,SSL_R_BAD_WRITE_RETRY);

   732 		return(-1);

   733 		}

   734 

   735 	for (;;)

   736 		{

   737 		clear_sys_error();

   738 		if (s->wbio != NULL)

   739 			{

   740 			s->rwstate=SSL_WRITING;

   741 			i=BIO_write(s->wbio,

   742 				(char *)&(s->s3->wbuf.buf[s->s3->wbuf.offset]),

   743 				(unsigned int)s->s3->wbuf.left);

   744 			}

   745 		else

   746 			{

   747 			SSLerr(SSL_F_SSL3_WRITE_PENDING,SSL_R_BIO_NOT_SET);

   748 			i= -1;

   749 			}

   750 		if (i == s->s3->wbuf.left)

   751 			{

   752 			s->s3->wbuf.left=0;

   753 			s->rwstate=SSL_NOTHING;

   754 			return(s->s3->wpend_ret);

   755 			}

   756 		else if (i <= 0)

   757 			return(i);

   758 		s->s3->wbuf.offset+=i;

   759 		s->s3->wbuf.left-=i;

   760 		}

   761 	}

   762 

   763 /* Return up to 'len' payload bytes received in 'type' records.

   764  * 'type' is one of the following:

   765  *

   766  *   -  SSL3_RT_HANDSHAKE (when ssl3_get_message calls us)

   767  *   -  SSL3_RT_APPLICATION_DATA (when ssl3_read calls us)

   768  *   -  0 (during a shutdown, no data has to be returned)

   769  *

   770  * If we don't have stored data to work from, read a SSL/TLS record first

   771  * (possibly multiple records if we still don't have anything to return).

   772  *

   773  * This function must handle any surprises the peer may have for us, such as

   774  * Alert records (e.g. close_notify), ChangeCipherSpec records (not really

   775  * a surprise, but handled as if it were), or renegotiation requests.

   776  * Also if record payloads contain fragments too small to process, we store

   777  * them until there is enough for the respective protocol (the record protocol

   778  * may use arbitrary fragmentation and even interleaving):

   779  *     Change cipher spec protocol

   780  *             just 1 byte needed, no need for keeping anything stored

   781  *     Alert protocol

   782  *             2 bytes needed (AlertLevel, AlertDescription)

   783  *     Handshake protocol

   784  *             4 bytes needed (HandshakeType, uint24 length) -- we just have

   785  *             to detect unexpected Client Hello and Hello Request messages

   786  *             here, anything else is handled by higher layers

   787  *     Application data protocol

   788  *             none of our business

   789  */

   790 int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)

   791 	{

   792 	int al,i,j,ret;

   793 	unsigned int n;

   794 	SSL3_RECORD *rr;

   795 	void (*cb)(const SSL *ssl,int type2,int val)=NULL;

   796 

   797 	if (s->s3->rbuf.buf == NULL) /* Not initialized yet */

   798 		if (!ssl3_setup_buffers(s))

   799 			return(-1);

   800 

   801 	if ((type && (type != SSL3_RT_APPLICATION_DATA) && (type != SSL3_RT_HANDSHAKE) && type) ||

   802 	    (peek && (type != SSL3_RT_APPLICATION_DATA)))

   803 		{

   804 		SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR);

   805 		return -1;

   806 		}

   807 

   808 	if ((type == SSL3_RT_HANDSHAKE) && (s->s3->handshake_fragment_len > 0))

   809 		/* (partially) satisfy request from storage */

   810 		{

   811 		unsigned char *src = s->s3->handshake_fragment;

   812 		unsigned char *dst = buf;

   813 		unsigned int k;

   814 

   815 		/* peek == 0 */

   816 		n = 0;

   817 		while ((len > 0) && (s->s3->handshake_fragment_len > 0))

   818 			{

   819 			*dst++ = *src++;

   820 			len--; s->s3->handshake_fragment_len--;

   821 			n++;

   822 			}

   823 		/* move any remaining fragment bytes: */

   824 		for (k = 0; k < s->s3->handshake_fragment_len; k++)

   825 			s->s3->handshake_fragment[k] = *src++;

   826 		return n;

   827 	}

   828 

   829 	/* Now s->s3->handshake_fragment_len == 0 if type == SSL3_RT_HANDSHAKE. */

   830 

   831 	if (!s->in_handshake && SSL_in_init(s))

   832 		{

   833 		/* type == SSL3_RT_APPLICATION_DATA */

   834 		i=s->handshake_func(s);

   835 		if (i < 0) return(i);

   836 		if (i == 0)

   837 			{

   838 			SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);

   839 			return(-1);

   840 			}

   841 		}

   842 start:

   843 	s->rwstate=SSL_NOTHING;

   844 

   845 	/* s->s3->rrec.type	    - is the type of record

   846 	 * s->s3->rrec.data,    - data

   847 	 * s->s3->rrec.off,     - offset into 'data' for next read

   848 	 * s->s3->rrec.length,  - number of bytes. */

   849 	rr = &(s->s3->rrec);

   850 

   851 	/* get new packet if necessary */

   852 	if ((rr->length == 0) || (s->rstate == SSL_ST_READ_BODY))

   853 		{

   854 		ret=ssl3_get_record(s);

   855 		if (ret <= 0) return(ret);

   856 		}

   857 

   858 	/* we now have a packet which can be read and processed */

   859 

   860 	if (s->s3->change_cipher_spec /* set when we receive ChangeCipherSpec,

   861 	                               * reset by ssl3_get_finished */

   862 		&& (rr->type != SSL3_RT_HANDSHAKE))

   863 		{

   864 		al=SSL_AD_UNEXPECTED_MESSAGE;

   865 		SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_DATA_BETWEEN_CCS_AND_FINISHED);

   866 		goto f_err;

   867 		}

   868 

   869 	/* If the other end has shut down, throw anything we read away

   870 	 * (even in 'peek' mode) */

   871 	if (s->shutdown & SSL_RECEIVED_SHUTDOWN)

   872 		{

   873 		rr->length=0;

   874 		s->rwstate=SSL_NOTHING;

   875 		return(0);

   876 		}

   877 

   878 

   879 	if (type == rr->type) /* SSL3_RT_APPLICATION_DATA or SSL3_RT_HANDSHAKE */

   880 		{

   881 		/* make sure that we are not getting application data when we

   882 		 * are doing a handshake for the first time */

   883 		if (SSL_in_init(s) && (type == SSL3_RT_APPLICATION_DATA) &&

   884 			(s->enc_read_ctx == NULL))

   885 			{

   886 			al=SSL_AD_UNEXPECTED_MESSAGE;

   887 			SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_APP_DATA_IN_HANDSHAKE);

   888 			goto f_err;

   889 			}

   890 

   891 		if (len <= 0) return(len);

   892 

   893 		if ((unsigned int)len > rr->length)

   894 			n = rr->length;

   895 		else

   896 			n = (unsigned int)len;

   897 

   898 		memcpy(buf,&(rr->data[rr->off]),n);

   899 		if (!peek)

   900 			{

   901 			rr->length-=n;

   902 			rr->off+=n;

   903 			if (rr->length == 0)

   904 				{

   905 				s->rstate=SSL_ST_READ_HEADER;

   906 				rr->off=0;

   907 				}

   908 			}

   909 		return(n);

   910 		}

   911 

   912 

   913 	/* If we get here, then type != rr->type; if we have a handshake

   914 	 * message, then it was unexpected (Hello Request or Client Hello). */

   915 

   916 	/* In case of record types for which we have 'fragment' storage,

   917 	 * fill that so that we can process the data at a fixed place.

   918 	 */

   919 		{

   920 		unsigned int dest_maxlen = 0;

   921 		unsigned char *dest = NULL;

   922 		unsigned int *dest_len = NULL;

   923 

   924 		if (rr->type == SSL3_RT_HANDSHAKE)

   925 			{

   926 			dest_maxlen = sizeof s->s3->handshake_fragment;

   927 			dest = s->s3->handshake_fragment;

   928 			dest_len = &s->s3->handshake_fragment_len;

   929 			}

   930 		else if (rr->type == SSL3_RT_ALERT)

   931 			{

   932 			dest_maxlen = sizeof s->s3->alert_fragment;

   933 			dest = s->s3->alert_fragment;

   934 			dest_len = &s->s3->alert_fragment_len;

   935 			}

   936 

   937 		if (dest_maxlen > 0)

   938 			{

   939 			n = dest_maxlen - *dest_len; /* available space in 'dest' */

   940 			if (rr->length < n)

   941 				n = rr->length; /* available bytes */

   942 

   943 			/* now move 'n' bytes: */

   944 			while (n-- > 0)

   945 				{

   946 				dest[(*dest_len)++] = rr->data[rr->off++];

   947 				rr->length--;

   948 				}

   949 

   950 			if (*dest_len < dest_maxlen)

   951 				goto start; /* fragment was too small */

   952 			}

   953 		}

   954 

   955 	/* s->s3->handshake_fragment_len == 4  iff  rr->type == SSL3_RT_HANDSHAKE;

   956 	 * s->s3->alert_fragment_len == 2      iff  rr->type == SSL3_RT_ALERT.

   957 	 * (Possibly rr is 'empty' now, i.e. rr->length may be 0.) */

   958 

   959 	/* If we are a client, check for an incoming 'Hello Request': */

   960 	if ((!s->server) &&

   961 		(s->s3->handshake_fragment_len >= 4) &&

   962 		(s->s3->handshake_fragment[0] == SSL3_MT_HELLO_REQUEST) &&

   963 		(s->session != NULL) && (s->session->cipher != NULL))

   964 		{

   965 		s->s3->handshake_fragment_len = 0;

   966 

   967 		if ((s->s3->handshake_fragment[1] != 0) ||

   968 			(s->s3->handshake_fragment[2] != 0) ||

   969 			(s->s3->handshake_fragment[3] != 0))

   970 			{

   971 			al=SSL_AD_DECODE_ERROR;

   972 			SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_HELLO_REQUEST);

   973 			goto f_err;

   974 			}

   975 

   976 		if (s->msg_callback)

   977 			s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, s->s3->handshake_fragment, 4, s, s->msg_callback_arg);

   978 

   979 		if (SSL_is_init_finished(s) &&

   980 			!(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) &&

   981 			!s->s3->renegotiate)

   982 			{

   983 			ssl3_renegotiate(s);

   984 			if (ssl3_renegotiate_check(s))

   985 				{

   986 				i=s->handshake_func(s);

   987 				if (i < 0) return(i);

   988 				if (i == 0)

   989 					{

   990 					SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);

   991 					return(-1);

   992 					}

   993 

   994 				if (!(s->mode & SSL_MODE_AUTO_RETRY))

   995 					{

   996 					if (s->s3->rbuf.left == 0) /* no read-ahead left? */

   997 						{

   998 						BIO *bio;

   999 						/* In the case where we try to read application data,

  1000 						 * but we trigger an SSL handshake, we return -1 with

  1001 						 * the retry option set.  Otherwise renegotiation may

  1002 						 * cause nasty problems in the blocking world */

  1003 						s->rwstate=SSL_READING;

  1004 						bio=SSL_get_rbio(s);

  1005 						BIO_clear_retry_flags(bio);

  1006 						BIO_set_retry_read(bio);

  1007 						return(-1);

  1008 						}

  1009 					}

  1010 				}

  1011 			}

  1012 		/* we either finished a handshake or ignored the request,

  1013 		 * now try again to obtain the (application) data we were asked for */

  1014 		goto start;

  1015 		}

  1016 

  1017 	if (s->s3->alert_fragment_len >= 2)

  1018 		{

  1019 		int alert_level = s->s3->alert_fragment[0];

  1020 		int alert_descr = s->s3->alert_fragment[1];

  1021 

  1022 		s->s3->alert_fragment_len = 0;

  1023 

  1024 		if (s->msg_callback)

  1025 			s->msg_callback(0, s->version, SSL3_RT_ALERT, s->s3->alert_fragment, 2, s, s->msg_callback_arg);

  1026 

  1027 		if (s->info_callback != NULL)

  1028 			cb=s->info_callback;

  1029 		else if (s->ctx->info_callback != NULL)

  1030 			cb=s->ctx->info_callback;

  1031 

  1032 		if (cb != NULL)

  1033 			{

  1034 			j = (alert_level << 8) | alert_descr;

  1035 			cb(s, SSL_CB_READ_ALERT, j);

  1036 			}

  1037 

  1038 		if (alert_level == 1) /* warning */

  1039 			{

  1040 			s->s3->warn_alert = alert_descr;

  1041 			if (alert_descr == SSL_AD_CLOSE_NOTIFY)

  1042 				{

  1043 				s->shutdown |= SSL_RECEIVED_SHUTDOWN;

  1044 				return(0);

  1045 				}

  1046 			}

  1047 		else if (alert_level == 2) /* fatal */

  1048 			{

  1049 			char tmp[16];

  1050 

  1051 			s->rwstate=SSL_NOTHING;

  1052 			s->s3->fatal_alert = alert_descr;

  1053 			SSLerr(SSL_F_SSL3_READ_BYTES, SSL_AD_REASON_OFFSET + alert_descr);

  1054 			BIO_snprintf(tmp,sizeof tmp,"%d",alert_descr);

  1055 			ERR_add_error_data(2,"SSL alert number ",tmp);

  1056 			s->shutdown|=SSL_RECEIVED_SHUTDOWN;

  1057 			SSL_CTX_remove_session(s->ctx,s->session);

  1058 			return(0);

  1059 			}

  1060 		else

  1061 			{

  1062 			al=SSL_AD_ILLEGAL_PARAMETER;

  1063 			SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNKNOWN_ALERT_TYPE);

  1064 			goto f_err;

  1065 			}

  1066 

  1067 		goto start;

  1068 		}

  1069 

  1070 	if (s->shutdown & SSL_SENT_SHUTDOWN) /* but we have not received a shutdown */

  1071 		{

  1072 		s->rwstate=SSL_NOTHING;

  1073 		rr->length=0;

  1074 		return(0);

  1075 		}

  1076 

  1077 	if (rr->type == SSL3_RT_CHANGE_CIPHER_SPEC)

  1078 		{

  1079 		/* 'Change Cipher Spec' is just a single byte, so we know

  1080 		 * exactly what the record payload has to look like */

  1081 		if (	(rr->length != 1) || (rr->off != 0) ||

  1082 			(rr->data[0] != SSL3_MT_CCS))

  1083 			{

  1084 			al=SSL_AD_ILLEGAL_PARAMETER;

  1085 			SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_CHANGE_CIPHER_SPEC);

  1086 			goto f_err;

  1087 			}

  1088 

  1089 		/* Check we have a cipher to change to */

  1090 		if (s->s3->tmp.new_cipher == NULL)

  1091 			{

  1092 			al=SSL_AD_UNEXPECTED_MESSAGE;

  1093 			SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_CCS_RECEIVED_EARLY);

  1094 			goto f_err;

  1095 			}

  1096 

  1097 		rr->length=0;

  1098 

  1099 		if (s->msg_callback)

  1100 			s->msg_callback(0, s->version, SSL3_RT_CHANGE_CIPHER_SPEC, rr->data, 1, s, s->msg_callback_arg);

  1101 

  1102 		s->s3->change_cipher_spec=1;

  1103 		if (!ssl3_do_change_cipher_spec(s))

  1104 			goto err;

  1105 		else

  1106 			goto start;

  1107 		}

  1108 

  1109 	/* Unexpected handshake message (Client Hello, or protocol violation) */

  1110 	if ((s->s3->handshake_fragment_len >= 4) &&	!s->in_handshake)

  1111 		{

  1112 		if (((s->state&SSL_ST_MASK) == SSL_ST_OK) &&

  1113 			!(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS))

  1114 			{

  1115 #if 0 /* worked only because C operator preferences are not as expected (and

  1116        * because this is not really needed for clients except for detecting

  1117        * protocol violations): */

  1118 			s->state=SSL_ST_BEFORE|(s->server)

  1119 				?SSL_ST_ACCEPT

  1120 				:SSL_ST_CONNECT;

  1121 #else

  1122 			s->state = s->server ? SSL_ST_ACCEPT : SSL_ST_CONNECT;

  1123 #endif

  1124 			s->new_session=1;

  1125 			}

  1126 		i=s->handshake_func(s);

  1127 		if (i < 0) return(i);

  1128 		if (i == 0)

  1129 			{

  1130 			SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);

  1131 			return(-1);

  1132 			}

  1133 

  1134 		if (!(s->mode & SSL_MODE_AUTO_RETRY))

  1135 			{